Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324

Hunt Hypothesis

This hunt hypothesis targets adversaries actively exploiting the critical SAP NetWeaver vulnerability (CVE-2025-31324) by identifying specific forensic artifacts that signal successful exploitation attempts within the environment. Proactive hunting for these indicators in Azure Sentinel is essential to rapidly detect and contain potential breaches before attackers can establish persistence or escalate privileges on this widely deployed enterprise infrastructure.

YARA Rule

rule APT_SAP_NetWeaver_Exploitation_Activity_Apr25_1 : SCRIPT {
   meta:
      description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
      reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
      author = "Florian Roth"
      date = "2025-04-25"
      score = 70
      id = "1ad16960-f059-57cd-97ba-58f2be6ca3f8"
   strings:
      $x01 = "/helper.jsp?cmd=" ascii wide
      $x02 = "/cache.jsp?cmd=" ascii wide
   condition:
      filesize < 20MB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SAP NetWeaver CVE-2025-31324 detection rule, including targeted filters and exclusions:

• Scenario: Automated Backup Operations via SAP Control Center (SAC)

  • Context: The nightly scheduled backup job executed by the sapcontrol service creates temporary forensic artifacts in the /usr/sap/<SID>/SYS/global/backup directory. These artifacts mimic the file creation patterns and registry changes associated with the exploitation activity of CVE-2025-31324, specifically regarding the handling of XML configuration files during the backup process.
  • Filter/Exclusion: Exclude events where the Process Name is sapcontrol.exe (or SAPControl) AND the Source Directory contains /backup. Additionally, filter out alerts occurring within the defined maintenance window (e.g., 02:00–04:00 local time).

• Scenario: Third-Party Security Scanning by Qualys or Tenable

  • Context: During a scheduled vulnerability assessment, tools like Qualys Cloud Agent or Tenable Nessus actively probe the SAP NetWeaver ports and inject test payloads. The scanner generates specific forensic logs and temporary files in the application server’s working directory that match the signature of an active exploitation attempt for CVE-2025-31324, particularly when testing the XML parsing module.
  • Filter/Exclusion: Create a rule to suppress alerts where the Initiating Process is qualys_agent.exe, tenable_nessus_service.exe, or vuln_scan_daemon. Ensure the exclusion applies only when the User Account is a dedicated service account (e.g., svc-qualys-scan) rather than an interactive user.