Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324

Hunt Hypothesis

This hunt hypothesis identifies adversaries actively exploiting the critical SAP NetWeaver vulnerability (CVE-2025-31324) by analyzing forensic artifacts that indicate successful exploitation attempts within the environment. Proactively hunting for these specific indicators in Azure Sentinel is essential to rapidly detect and contain potential breaches before attackers can establish persistence or exfiltrate sensitive data from this high-value enterprise asset.

YARA Rule

rule APT_SAP_NetWeaver_Exploitation_Activity_Apr25_2 : SCRIPT {
   meta:
      description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
      reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
      author = "Florian Roth"
      date = "2025-04-25"
      score = 70
      id = "3b7d3f94-88a9-5686-8a23-ac4040c0e6c1"
   strings:
      $x03 = "MSBuild.exe c:\\programdata\\" ascii wide
   condition:
      filesize < 20MB and 1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the SAP NetWeaver CVE-2025-31324 detection rule, along with suggested filters and exclusions:

• Scenario: Scheduled SAP Security Patching Jobs (SWPM)

  • Context: The nightly “Software Update Manager” (SWPM) job runs to apply cumulative patches. During the update process, the sapup service creates temporary forensic logs and modifies specific registry keys in the NetWeaver directory that mimic the exploitation signatures of CVE-2025-31324.
  • Filter/Exclusion: Exclude events where the parent process is SWPM.exe or saphostctrl running under the system account (NT AUTHORITY\SYSTEM) during a defined maintenance window (e.g., 02:00–04:00 UTC).

• Scenario: SAP Solution Manager (SolMan) Diagnostic Scans

  • Context: The automated “ST06” or “RZ10” diagnostic agents within SAP Solution Manager perform deep integrity checks on the NetWeaver ABAP stack. These scans generate file system artifacts and network connections that trigger the rule’s forensic detection logic for exploitation activity.
  • Filter/Exclusion: Filter out alerts where the source IP belongs to the designated SolMan server subnet (e.g., 10.20.30.x) and the detected process name contains “SolManAgent” or “SAPLogon”.

• Scenario: Third-Party Backup Agents (Veeam/Commvault)

  • Context: Enterprise backup solutions like Veeam Backup & Replication or Commvault perform incremental backups of the SAP NetWeaver database and application directories. The agents mount volumes and read forensic artifacts, causing file access patterns that resemble an active exploitation attempt.