sap break glass account login

Severity: low
Time window: 1h
Match by: userid
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4624: An account was successfully logged on.
Security-Auditing	Event ID 4625: An account failed to log on.
Security-Auditing	Event ID 4648: A logon was attempted using explicit credentials.

Rule body

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_break_glass_account_login {

  meta:
    author = "Google Cloud Security"
    description = "Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios"
    severity = "Low"
    tactic = "TA0001"
    technique = "T1078"

  events:
    $e.metadata.log_type = "SAP_SECURITY_AUDIT"
    (
        $e.additional.fields["msg_1"] = /^AU1$|^AU5$/ or
        $e.metadata.event_type = "USER_LOGIN"
    )
    $e.principal.user.userid = $userid
    $userid = /^DDIC$|^EARLYWATCH$|^SAP\*$|^TMSADM$/ nocase

  match:
    $userid over 1h

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $risk_score = if($event_count < 10, 20, 40)
    $vendor_name = array_distinct($e.metadata.vendor_name)
    $product_name = array_distinct($e.metadata.product_name)
    $product_severity = array_distinct($e.security_result.severity)
    $event_description = array_distinct($e.metadata.description)
    $victim_name = array_distinct($e.target.user.userid)
    $adversary_name = array_distinct($e.principal.user.userid)
    $result_time = min($e.metadata.event_timestamp.seconds)

  condition:
    $e
}

YARA-L rule structure

Condition

Fires when at least one $e event in the 1h window.

Events

`$e` `USER_LOGIN` (`4624`, `4625`, `4648`)

metadata.log_type = "SAP_SECURITY_AUDIT"
additional.fields["msg_1"] matches "^AU1$|^AU5$"
principal.user.userid matches "^DDIC$|^EARLYWATCH$|^SAP\*$|^TMSADM$"

Match and correlation

Match key: $userid (principal.user.userid)
Within: 1h

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`event_count`	`count_distinct($e.metadata.id)`
`risk_score`	`if($event_count < 10, 20, 40)`
`vendor_name`	`array_distinct($e.metadata.vendor_name)`
`product_name`	`array_distinct($e.metadata.product_name)`
`product_severity`	`array_distinct($e.security_result.severity)`
`event_description`	`array_distinct($e.metadata.description)`
`victim_name`	`array_distinct($e.target.user.userid)`
`adversary_name`	`array_distinct($e.principal.user.userid)`
`result_time`	`min($e.metadata.event_timestamp.seconds)`