SAP RFC SXPG_CALL_SYSTEM OS Command Execution with ZREDTEAM Entry

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects unauthorized execution of SAP RFC exploitation scripts that leverage SXPG_CALL_SYSTEM or SXPG_COMMAND_INSERT to inject and execute OS commands. This behavior is associated with exploitation tactics targeting SAP environments, specifically identified by the presence of custom ZREDTEAM artifacts and known malicious script naming conventions.