Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when an SAP audit message ID appears in security audit logs but is absent from the defined monitoring configuration table, which could indicate attempts to bypass or disable monitoring controls.
A user was added to a BTP role collection carrying subaccount, directory, or global account administrator rights
A BTP identity provider trust configuration was created, modified, or deleted
A BTP service instance or service binding was created, modified, or deleted through the Service Manager API
A BTP subaccount entity was deleted from the global account
A Build Work Zone role was added to or removed from a BTP role collection
A Build Work Zone site was created or its content was modified
Detects when a user performs a bulk data download (large volume of data) shortly after accessing restricted or sensitive SAP objects such as sensitive tables, ABAP programs, or transactions.
Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.
This rule detects when a user starts an ABAP program that is on a list of deprecated or unsafe programs within an SAP environment using SAP Security Audit logs.
Page 2 of 76