SAP NetWeaver systems can be attractive targets because of the business-critical applications and data they support. The source defines several hunts focused on Visual Composer exploitation and related post-exploitation activity.
Coverage includes CVE-2025-31324 and the related CVE-2025-42999 chain.
HTTP and Filename Indicators
The first query looks for access to the metadata uploader and several JSP filenames associated with the hunting scenario:
full_log:("/developmentserver/metadatauploader" or "helper.jsp" or "cache.jsp" or "shell.jsp" or "usage.jsp" or "user.jsp" or "readme.jsp")The source recorded 26 results during the previous 30 days.
File Integrity Monitoring
The second query searches for added or modified JSP files under SAP Java application paths:
rule.groups:syscheck and syscheck.event:(added or modified) and syscheck.path:(*/j2ee/cluster/apps/*.jsp or */irj/*.jsp or *helper.jsp or *cache.jsp or *shell.jsp or *usage.jsp or *user.jsp or *readme.jsp)
The source recorded zero matches for this file hunt.
Windows-Hosted SAP Process Activity
For SAP systems hosted on Windows, the source monitors disp+work.exe or java.exe spawning shells or download utilities:
data.win.system.eventID:1 and data.win.eventdata.parentImage:(*\disp+work.exe or *\java.exe) and data.win.eventdata.image:(*\cmd.exe or *\powershell.exe or *\pwsh.exe or *\certutil.exe or *\curl.exe)
This query produced 941 results in the previous 30 days.
Understanding the Different Volumes
The three hunts have very different result counts. This is important.
The product-specific HTTP indicators are relatively focused. The file-integrity hunt is even narrower. The Windows process behavior is broader and can capture legitimate Java or SAP operations.
That means the process query should be tuned with host and command-line context before being treated as a high-severity alert.
Investigation Workflow
For an HTTP match, determine whether:
the request reached a SAP NetWeaver system;
the source IP is expected;
a JSP file was created or modified;
Java or SAP processes launched a shell;
outbound downloads occurred afterward.
For a process match, review the exact child process and command line. Repeated approved automation can be baselined, while rare shell execution should receive more scrutiny.
Correlation
A particularly strong sequence would be:
metadata uploader access → new JSP file → java.exe → powershell.exe
The source queries are designed to provide these separate visibility points.
Operational Value
Rather than relying on one indicator, this approach combines web logs, file integrity monitoring, and endpoint process telemetry.
For critical SAP systems, that layered view can help distinguish benign application behavior from signs of successful exploitation.
