Google SecOps
@GoogleSecOps4 followers1,217 downloads359 copies1 like18,019 views
727 detections
Filters
Last updated
All Time
Detection languages
725
2
Categories
187
173
109
81
75
Platforms
245
187
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
223
173
97
92
75
CVEs
4
4
This rule monitors SAP Change Document logs to identify when highly privileged SAP profiles are assigned to users. This activity is indicative of potential privilege escalation, as it involves modifying user access rights within the SAP environment to grant elevated permissions.
This rule detects the assignment of sensitive or highly privileged roles to users within an SAP environment by monitoring change documents. It focuses on identifying potentially unauthorized or high-risk configuration changes where specific sensitive roles are assigned, which could indicate a privilege escalation attempt.
Detects unauthorized in-memory data modifications occurring during an SAP ABAP debugging session. Specifically, it flags instances where a user modifies data (using the CUL action) while actively debugging their own or another session, excluding predefined SAP administrative accounts.
Detects the execution of high-risk SAP ABAP programs identified in a sensitive program list. These programs, often used for administrative or internal testing purposes, can bypass standard SAP transaction-level authorization checks, making them attractive targets for privilege escalation or unauthorized data access.
Detects external RFC calls to generic SAP table-read modules (such as RFC_READ_TABLE, BBP_RFC_READ_TABLE, or RFC_GET_TABLE_ENTRIES) via the SAP Gateway. This pattern is indicative of unauthorized reconnaissance or data staging attempts within an SAP environment by non-service accounts.
Detects the deactivation of the global auditing state in SAP HANA, which stops all audit logging.
Detects multiple password changes (BU2) by a single actor or targeting a single user across systems.
This rule detects the execution of sensitive SAP function modules via Remote Function Call (RFC) using SAP Security Audit logs (AUK). It monitors for specific function modules defined in a sensitive list being executed by non-administrative users. The rule provides context including the function group and transaction code involved in the execution.
Detects unauthorized or suspicious modifications to authorization objects (via PFCG transaction) within SAP environments, specifically targeting sensitive roles. The rule correlates these changes with SAP security audit logs to identify the user's session context and ensure the action was performed by someone not listed as an authorized SAP administrator.
Detects direct access to highly sensitive SAP tables (USR02, PAYR, P0002) via RFC logon. This specifically monitors for potential theft of user hashes (USR02), payroll data (PAYR), or personal employee information (P0002).
Page 3 of 73