sap brute force rfc logon

Google SecOps@GoogleSecOps

•updated Apr 20, 2026•0•0•1

Identifies brute force attacks on SAP systems using RFC logons. Detects a single IP attempting to sign in to several systems or clients within a 1-hour interval, indicating potential credential stuffing or internal lateral movement.