Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects unauthorized modifications to the SAP Security Audit Log configuration by monitoring specific SAP system message codes (AUE, AUF, AUI, AUJ, FU0, E05) associated with audit trail changes, excluding known administrative accounts.
This rule monitors SAP environments by correlating Change Documents (PFCG) with Security Audit logs to detect when a high-privilege role is assigned to a user. It specifically looks for additions to the AGR_USERS table and correlates this activity with security audit events to attribute the action to a specific source IP and user.
Detects administrative user management (Create/Alter/Drop) and schema deletion within SAP HANA DB.
This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.
Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG.
Detects the assignment of administrative privileges or roles within SAP HANA DB.
Detects changes to SAP HANA audit policies (Create, Alter, Drop) which could indicate an attempt to evade logging.
sap multi terminal logon
YARA-L
Identifies successful logons for the same User ID from multiple different terminal IDs or client hostnames in a short timeframe, indicating potential credential sharing or session theft.
Detects SAP user administration activities including the creation, deletion, or unlocking of user accounts, as captured by SAP Security Audit logs (messages AU7, AU8, AU9, AUA).
This rule monitors SAP systems for high-privileged role assignments by correlating Change Documents (PFCG, AGR_USERS table) with Security Audit logs. It identifies instances where a non-administrative user account assigns a role to another user (or themselves), providing visibility into potential unauthorized privilege escalation or account manipulation within the SAP environment.
Page 5 of 76