Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
Identifies brute force attacks on SAP systems using RFC logons. Detects a single IP attempting to sign in to several systems or clients within a 1-hour interval, indicating potential credential stuffing or internal lateral movement.
Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG.
Detects direct execution and testing of SAP Function Modules via SE37 test frame. This identifies correlation between a transaction start (AU7) and a function module call (BU4) in close succession
Detects the assignment of administrative privileges or roles within SAP HANA DB.
Detects changes to SAP HANA audit policies (Create, Alter, Drop) which could indicate an attempt to evade logging.
sap multi terminal logon
YARA-L
Identifies successful logons for the same User ID from multiple different terminal IDs or client hostnames in a short timeframe, indicating potential credential sharing or session theft.
Detects SAP user administration activities including the creation, deletion, or unlocking of user accounts, as captured by SAP Security Audit logs (messages AU7, AU8, AU9, AUA).
This rule monitors SAP systems for high-privileged role assignments by correlating Change Documents (PFCG, AGR_USERS table) with Security Audit logs. It identifies instances where a non-administrative user account assigns a role to another user (or themselves), providing visibility into potential unauthorized privilege escalation or account manipulation within the SAP environment.
Detects high-volume data downloads (AUY) from SAP to a local frontend file, potentially indicating exfiltration.
Detects the assignment of highly privileged SAP profiles via Change Documents.
Page 2 of 73