Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a user invokes a function module on the deprecated or unsafe module list within SAP environments based on SAP security audit logs.
Detects users authenticating to SAP via Dialog Logons from IP addresses that are outside of approved network ranges and RFC1918 internal networks, potentially indicating unauthorized or external access.
A file was downloaded from an SAP system by a host matching a threat intelligence indicator
Detects dynamic ABAP programming events (Insert, Generate, Delete) in SAP environments, excluding pre-defined authorized transactions.
The SAP FTP server allowlist was empty or populated with wildcard entries
A SPNEGO authentication token was replayed against an SAP system
Detects failed internal SAP logon attempts (AU2) targeting an invalid or non-existent client, indicating potential misconfiguration or an unauthorized access probe.
Detects when a privileged SAP account modifies the master record of a different user within a specified timeframe.
Detects successful or failed logon activity by a privileged SAP account on a production system using SAP Security Audit logs.
Detects modifications to privileged SAP accounts' user master records or authorizations, indicating potential account manipulation or privilege abuse.
Page 3 of 76