SAP RFC SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT OS Command Execution
This rule detects potential exploitation of SAP Remote Function Call (RFC) mechanisms, specifically targeting abuse of SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT which allow execution of OS commands via SAP. It identifies the execution of known malicious SAP-related scripts, suspicious OS commands (such as whoami, reading /etc/passwd or /etc/shadow) spawned by SAP work processes, and command line activity originating from privileged SAP service accounts.
Microsoft Sentinel (KQL)
