sap sensitive rfc function module execution
This rule detects the execution of sensitive SAP function modules via Remote Function Call (RFC) using SAP Security Audit logs (AUK). It monitors for specific function modules defined in a sensitive list being executed by non-administrative users. The rule provides context including the function group and transaction code involved in the execution.
YARA-L
