SAP RFC SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT OS Command Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•2•0•3

Detects anomalous process execution patterns originating from SAP system processes or accounts, such as SAP work processes spawning shell commands, usage of known RCE-related scripts, and privileged accounts like WF-BATCH or TMSADM invoking administrative command-line tools.