Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects when a dialog user reads a restricted SAP table using generic table browser transactions such as SE11, SE16, or SE16N.
This rule detects when a user executes a sensitive or restricted transaction code in an SAP system, as identified by SAP security audit logs (AU3/AU4 messages). It tracks non-excluded users performing these transactions and aggregates them over a 75-minute window.
An ABAP program invoked a remote function call (RFC) using a destination resolved at runtime, which may indicate lateral movement or unauthorized internal communication within an SAP environment.
Detects multiple distinct SAP users authenticating successfully from a single source IP address within a short time window (30 minutes), potentially indicating compromised credentials or shared access anomalies.
A transaction code lock was removed through message ID AUQ
Detects the execution of the SAP Transport Organizer transaction (SE09), which is critical for managing development objects and transport requests. Execution by unauthorized users may indicate unauthorized system modification or bypassing of change management controls.
Detects the modification of a user's master record via an administrative action within SAP, which may indicate unauthorized account manipulation or privilege escalation.
Detects a process memory dump via comsvcs.dll using rundll32, covering multiple different techniques
sap impossible travel
YARA-L
Identifies two successful logons for the same User ID from two different geographic locations in a timeframe that is physically impossible to travel between, indicating credential sharing or theft.
Detects the deactivation of the SAP Security Audit Log (AUJ). This is a critical event as it stops further security logging.
Page 4 of 76