• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    sap security audit log user created deleted or unlocked

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Google SecOps@GoogleSecOps
    •updated Apr 20, 2026•0•0•1

    Detects SAP user administration activities including the creation, deletion, or unlocking of user accounts, as captured by SAP Security Audit logs (messages AU7, AU8, AU9, AUA).

    YARA-L

    Tags

    T1136 - Create AccountTA0003 - PersistenceUser Account CreatedUser Account DeletedUser Account ModifiedAdmin ActivitySaas ApplicationGeneric Application Log

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?