Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Detects a process memory dump via comsvcs.dll using rundll32, covering multiple different techniques
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
sap impossible travel
YARA-L
Identifies two successful logons for the same User ID from two different geographic locations in a timeframe that is physically impossible to travel between, indicating credential sharing or theft.
Detects the deactivation of the SAP Security Audit Log (AUJ). This is a critical event as it stops further security logging.
This rule monitors SAP environments by correlating Change Document logs (PFCG) with Security Audit logs (AUD) to detect when a sensitive or critical SAP role is assigned to a user. It specifically triggers when a change entry for the AGR_USERS table (User assignment to roles) is identified as an addition (CHNGIND='I') and the role is part of a predefined sensitive role list, while using the audit log to provide attribution for the action.
Detects rejected connections by Gateway ACLs (secinfo/reginfo), indicating an attempt to bypass network-layer security.
Detects unauthorized modifications to the SAP Security Audit Log configuration by monitoring specific SAP system message codes (AUE, AUF, AUI, AUJ, FU0, E05) associated with audit trail changes, excluding known administrative accounts.
This rule monitors SAP environments by correlating Change Documents (PFCG) with Security Audit logs to detect when a high-privilege role is assigned to a user. It specifically looks for additions to the AGR_USERS table and correlates this activity with security audit events to attribute the action to a specific source IP and user.
Detects administrative user management (Create/Alter/Drop) and schema deletion within SAP HANA DB.
This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.
Page 1 of 73