sap sensitive role authorization modification
Detects unauthorized or suspicious modifications to authorization objects (via PFCG transaction) within SAP environments, specifically targeting sensitive roles. The rule correlates these changes with SAP security audit logs to identify the user's session context and ensure the action was performed by someone not listed as an authorized SAP administrator.
YARA-L
