sap critical authorization value changed

/*
 * Copyright 2026 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule sap_critical_authorization_value_changed {

  meta:
    author = "Google Cloud Security"
    description = "Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG."
    severity = "Critical"
    tactic = "TA0004"
    technique = "T1098"

  events:
    $change.metadata.log_type = "SAP_CHANGE_DOCUMENT"
    $change.target.resource.attribute.labels["TABNAME"] = "CD1251"
    $change.target.resource.attribute.labels["CHNGIND"] = /J|U/
    $change.target.application = "PFCG"

    $role = $change.target.resource.product_object_id
    $admin = $change.principal.user.userid

    $auth_object = re.capture($change.target.resource.attribute.labels["TABKEY"], "^.{33}(.{10})")

  match:
    $admin, $role over 1h

  outcome:
    $admin_user = array_distinct($admin)
    $modified_role = array_distinct($role)
    $impacted_object = array_distinct($auth_object)
    $new_value = array_distinct($change.additional.fields["VALUE_NEW"])
    $system_id = array_distinct($change.target.application)
    $risk_score = 75

  condition:
    $change
}