SAP 'Overpass' CVSS 10.0 Vulnerability: Detection, Patching, and Hardening Guide for NetWeaver Defenders

---
title: SAP Application Server Process Spawning Shell or Script Interpreter
id: 3f8a2c14-7b9d-4e61-a2c3-9d5f7e1a4b82
status: experimental
description: Detects SAP NetWeaver server processes (jstart, sapstartsrv, disp+work, icman) spawning command shells or script interpreters, a strong indicator of web shell or RCE post-exploitation activity following compromise of an HTTP-facing SAP component such as the Overpass vulnerability.
references:
  - https://www.infosecurity-magazine.com/news/sap-patches-maximum-severity/
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\jstart.exe'
      - '\sapstartsrv.exe'
      - '\disp+work.exe'
      - '\icman.exe'
      - '\jlaunch.exe'
      - '\gwrd.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare SAP administrative startup scripts executed under the SAP service context during maintenance windows - baseline and exclude known management tooling
level: critical
---
title: Web Shell File Created in SAP Java Server Web Directory
id: 9c1e5d27-4a6b-48f3-b7d2-2e8c6f3a1d95
status: experimental
description: Detects creation of JSP, JS, or script files in SAP NetWeaver AS Java web application directories outside of deployment activity, consistent with web shell deployment after exploitation of a critical SAP vulnerability such as Overpass.
references:
  - https://www.infosecurity-magazine.com/news/sap-patches-maximum-severity/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\usr\sap\'
      - '\SAP\J2EE\'
      - '\j2ee\cluster\'
      - '\servlet_jsp\'
      - '\webapps\'
  selection_ext:
    TargetFilename|endswith:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.class'
  filter_deploy_user:
    User|contains:
      - 'deploysvc'
      - 'SAPService'
  condition: selection_path and selection_ext and not filter_deploy_user
falsepositives:
  - Legitimate application deployments via SAP deployment tools - correlate with change management records and deployment windows
level: high
---
title: SAP Service Account Executing Reconnaissance or Credential Access Commands
id: 5d2b7f38-1c4e-4a92-c6e1-8f3a9b2d7e46
status: experimental
description: Detects SAP service accounts (SIDadm, SAPServiceSID) executing discovery, credential access, or download commands, indicating post-exploitation hands-on-keyboard activity after compromise of an SAP application server.
references:
  - https://www.infosecurity-magazine.com/news/sap-patches-maximum-severity/
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.credential_access
  - attack.t1033
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection_user:
    User|contains:
      - 'adm'
      - 'SAPService'
  selection_cmd:
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'net group'
      - 'net localgroup'
      - 'nltest'
      - 'ipconfig /all'
      - 'lsadump'
      - 'sekurlsa'
      - 'vssadmin delete shadows'
      - 'reg save hklm\sam'
      - 'reg save hklm\system'
      - 'Invoke-WebRequest'
      - 'curl.exe'
      - 'certutil -urlcache'
  condition: selection_user and selection_cmd
falsepositives:
  - SAP Basis administrators performing legitimate maintenance under service accounts - tune against known admin accounts and maintenance windows
level: high

// Hunt 1: SAP NetWeaver server processes spawning shells or LOLBins (Windows + Linux via MDE)
let SapParentProcesses = dynamic(["jstart.exe", "sapstartsrv.exe", "disp+work.exe", "icman.exe", "jlaunch.exe", "gwrd.exe", "sapstartsrv", "jstart", "disp+work", "icman"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "wmic.exe", "certutil.exe", "bitsadmin.exe", "sh", "bash", "dash", "python", "perl", "curl", "wget", "nc", "ncat"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any (SapParentProcesses)
| where FileName has_any (SuspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
    FileName, ProcessCommandLine, AccountName, AccountDomain, ProcessId, InitiatingProcessId, SHA256
| sort by TimeGenerated desc;

// Hunt 2: Script file creation in SAP directories by non-deployment accounts
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("\\usr\\sap\\", "j2ee\\cluster", "servlet_jsp", "webapps", "/usr/sap/")
| where FileName endswith_any (".jsp", ".jspx", ".war", ".class", ".php", ".sh")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessAccountName !contains "deploy"
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType,
    InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, SHA256
| sort by TimeGenerated desc;

// Hunt 3: Outbound connections from SAP server processes to rare external destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("jstart.exe", "sapstartsrv.exe", "disp+work.exe", "icman.exe", "java.exe", "jstart", "disp+work")
| where RemoteIPType == "Public"
| where RemoteUrl !has_any ("sap.com", "microsoft.com") // tune: add known SAP support/update endpoints
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| where ConnectionCount < 50  // rare destinations surface C2 over routine SAP chatter
| sort by FirstSeen asc;

-- SAP Post-Exploitation Triage: web shells and shell spawns from SAP server processes
-- Deploy against SAP NetWeaver application servers (Windows and Linux)

LET sap_procs = pslist()
WHERE Name =~ '(?i)(jstart|sapstartsrv|disp\+work|icman|jlaunch|gwrd|java)'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM sap_procs)
  AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|wmic|certutil|sh|bash|dash|python|perl|curl|wget|nc)'

LET webshell_files = SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=[
  'C:/usr/sap/**/*.jsp',
  'D:/usr/sap/**/*.jsp',
  '/usr/sap/**/*.jsp',
  '/usr/sap/**/servlet_jsp/**',
  '/usr/sap/**/webapps/**/*.war'
])
WHERE Mtime > now() - 2592000  -- modified within last 30 days

SELECT 'suspicious_child_process' AS Artifact, Pid AS PID, Ppid AS ParentPID,
       Name AS ProcessName, CommandLine AS CmdLine, Username AS User,
       CreateTime AS Created, NULL AS FilePath, NULL AS FileModified
FROM suspicious_children
UNION ALL
SELECT 'recent_script_file' AS Artifact, NULL AS PID, NULL AS ParentPID,
       NULL AS ProcessName, NULL AS CmdLine, NULL AS User, NULL AS Created,
       FullPath AS FilePath, Mtime AS FileModified
FROM webshell_files
ORDER BY FileModified DESC

#!/bin/bash
# SAP Overpass Exposure Triage - run on each NetWeaver application server
# Collects: SAP instances, recent web content drops, listening services

echo "=== SAP Instance Inventory ==="
ls -d /usr/sap/*/* 2>/dev/null | grep -E '(J[0-9]+|D[0-9]+|DVEBMGS[0-9]+|ASCS[0-9]+)' || echo "No SAP instances found in /usr/sap"

echo ""
echo "=== SAP Kernel / Patch Level (run disp+work -v per instance for full detail) ==="
find /usr/sap -name "disp+work" -type f 2>/dev/null | while read -r dw; do
  echo "--- $dw ---"
  "$dw" -v 2>/dev/null | grep -iE "kernel|patch|release" | head -5
done

echo ""
echo "=== JSP/WAR files modified in last 30 days under /usr/sap (potential web shells) ==="
find /usr/sap -type f \( -name "*.jsp" -o -name "*.jspx" -o -name "*.war" \) -mtime -30 2>/dev/null -exec ls -la {} \;

echo ""
echo "=== Recently modified scripts/executables in SAP temp and work dirs ==="
find /usr/sap -type f \( -name "*.sh" -o -name "*.py" -o -name "*.pl" \) -mtime -14 2>/dev/null | head -50

echo ""
echo "=== SAP services listening (ICM/HTTP exposure check) ==="
ss -tlnp 2>/dev/null | grep -iE 'sap|jstart|disp|icman|java' || netstat -tlnp 2>/dev/null | grep -iE 'sap|jstart|disp|icman|java'

echo ""
echo "=== HTTP(S) ports exposed - confirm these are NOT reachable from untrusted networks ==="
ss -tlnp 2>/dev/null | grep -E ':(80[0-9][0-9]|44[0-9][0-9]|5[0-9][0-9][0-9]|32[0-9][0-9]|36[0-9][0-9])'

echo ""
echo "=== Child processes of SAP daemons (live shell-spawn check) ==="
for pid in $(pgrep -f 'jstart|sapstartsrv|disp\+work|icman'); do
  children=$(ps --ppid "$pid" -o pid,comm,args 2>/dev/null | grep -iE 'sh|bash|python|perl|curl|wget|nc')
  [ -n "$children" ] && echo "ALERT - SAP PID $pid spawned: $children"
done
echo "Triage complete."