APT_SAP_NetWeaver_Exploitation_Activity_Apr25_2

rule APT_SAP_NetWeaver_Exploitation_Activity_Apr25_2 : SCRIPT {
   meta:
      description = "Detects forensic artefacts related to exploitation activity of SAP NetWeaver CVE-2025-31324"
      reference = "https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/"
      author = "Florian Roth"
      date = "2025-04-25"
      score = 70
      id = "3b7d3f94-88a9-5686-8a23-ac4040c0e6c1"
   strings:
      $x03 = "MSBuild.exe c:\\programdata\\" ascii wide
   condition:
      filesize < 20MB and 1 of them
}