Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Identifies brute force attacks on SAP systems using RFC logons. Detects a single IP attempting to sign in to several systems or clients within a 1-hour interval, indicating potential credential stuffing or internal lateral movement.
Detects direct execution and testing of SAP Function Modules via SE37 test frame. This identifies correlation between a transaction start (AU7) and a function module call (BU4) in close succession
Detects when a user starts or interacts with the ABAP debugger on an SAP production system, which is a sensitive action that could indicate unauthorized debugging or privilege manipulation.
An account was unlocked and then authenticated from the same IP as the account that unlocked it
A single actor created or deleted SAP BTP subaccount users in bulk
An SAP BTP tenant that was recently active stopped producing audit logs
Detects when an SAP process opens an FTP session to a host that is not on the approved server list.
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
This rule detects when an SAP user generates audit records exceeding a configured hourly threshold (200 for high severity or 4000 for medium severity events) on their system. This behavior may indicate automated scanning, mass data extraction, or anomalous user activity within SAP environments.
Page 1 of 76