sap critical role assigned to new user
This rule monitors SAP environments by correlating Change Documents (PFCG) with Security Audit logs to detect when a high-privilege role is assigned to a user. It specifically looks for additions to the AGR_USERS table and correlates this activity with security audit events to attribute the action to a specific source IP and user.
YARA-L
