sap restricted transaction started
This rule detects when a user executes a sensitive or restricted transaction code in an SAP system, as identified by SAP security audit logs (AU3/AU4 messages). It tracks non-excluded users performing these transactions and aggregates them over a 75-minute window.
YARA-L
