sap sensitive tables direct access by rfc logon static list

Google SecOps@GoogleSecOps

•updated Apr 20, 2026•0•0•0

Detects direct access to highly sensitive SAP tables (USR02, PAYR, P0002) via RFC logon. This specifically monitors for potential theft of user hashes (USR02), payroll data (PAYR), or personal employee information (P0002).