sap sensitive tables direct access by rfc logon data table

Google SecOps@GoogleSecOps

•updated Apr 20, 2026•0•0•2

This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.