APT_SAP_NetWeaver_Exploitation_Activity_Apr25_1

rule APT_SAP_NetWeaver_Exploitation_Activity_Apr25_1 : SCRIPT {
   meta:
      description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
      reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
      author = "Florian Roth"
      date = "2025-04-25"
      score = 70
      id = "1ad16960-f059-57cd-97ba-58f2be6ca3f8"
   strings:
      $x01 = "/helper.jsp?cmd=" ascii wide
      $x02 = "/cache.jsp?cmd=" ascii wide
   condition:
      filesize < 20MB and 1 of them
}