sap sensitive role assignment correlation
This rule monitors SAP systems for high-privileged role assignments by correlating Change Documents (PFCG, AGR_USERS table) with Security Audit logs. It identifies instances where a non-administrative user account assigns a role to another user (or themselves), providing visibility into potential unauthorized privilege escalation or account manipulation within the SAP environment.
YARA-L
