Google SecOps
@GoogleSecOps4 followers1,217 downloads379 copies1 like18,177 views
758 detections
Filters
Last updated
All Time
Detection languages
756
2
Categories
189
188
109
81
77
Platforms
257
198
122
112
67
Products / Services
186
94
93
69
52
MITRE Techniques
237
181
109
95
79
CVEs
4
4
Detects direct access to highly sensitive SAP tables (USR02, PAYR, P0002) via RFC logon. This specifically monitors for potential theft of user hashes (USR02), payroll data (PAYR), or personal employee information (P0002).
Detects high-volume data downloads (AUY) from SAP to a local frontend file, potentially indicating exfiltration.
Detects the assignment of highly privileged SAP profiles via Change Documents.
This rule monitors SAP Change Document logs to identify when highly privileged SAP profiles are assigned to users. This activity is indicative of potential privilege escalation, as it involves modifying user access rights within the SAP environment to grant elevated permissions.
This rule detects the assignment of sensitive or highly privileged roles to users within an SAP environment by monitoring change documents. It focuses on identifying potentially unauthorized or high-risk configuration changes where specific sensitive roles are assigned, which could indicate a privilege escalation attempt.
Detects unauthorized in-memory data modifications occurring during an SAP ABAP debugging session. Specifically, it flags instances where a user modifies data (using the CUL action) while actively debugging their own or another session, excluding predefined SAP administrative accounts.
Detects the execution of high-risk SAP ABAP programs identified in a sensitive program list. These programs, often used for administrative or internal testing purposes, can bypass standard SAP transaction-level authorization checks, making them attractive targets for privilege escalation or unauthorized data access.
Detects the deactivation of the global auditing state in SAP HANA, which stops all audit logging.
Detects multiple password changes (BU2) by a single actor or targeting a single user across systems.
This rule detects the execution of sensitive SAP function modules via Remote Function Call (RFC) using SAP Security Audit logs (AUK). It monitors for specific function modules defined in a sensitive list being executed by non-administrative users. The rule provides context including the function group and transaction code involved in the execution.
Page 6 of 76