SAP RFC SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT OS Command Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

This rule detects the execution of scripts and commands associated with known SAP RFC exploitation attempts, including specific shell scripts used for RCE or credential extraction, as well as the invocation of SAP function modules like SXPG_CALL_SYSTEM for OS command execution. These patterns are consistent with post-exploitation activity or unauthorized system administration in SAP environments.