SAP RFC SXPG_CALL_SYSTEM OS Command Execution with ZREDTEAM Entry Injection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

This rule detects suspicious SAP RFC (Remote Function Call) activity, including the execution of OS commands via SXPG_CALL_SYSTEM, usage of custom ZREDTEAM command interfaces, and the presence of scripts or indicators related to SAP credential extraction (e.g., password hash access).