sap user creates and uses new user
Detects a suspicious pattern in SAP environments where an existing user creates a new account (AU7 - User created) and subsequently logs into that newly created account (AU1 - User logged on or AU5 - User logged on via RFC) from the same terminal/IP address within a 30-minute window, potentially indicating account takeover or unauthorized persistence.
YARA-L
