sap privileged account logon sweep from single ip
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
YARA-L
