sap credential reset followed by use from shared ip
Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.
YARA-L

Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.

Already have an account?