sap critical authorization value changed

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_critical_authorization_value_changed {

  meta:
    author = "Google Cloud Security"
    description = "Detects the modification of sensitive authorization objects (CD1251) within a role. This identifies potential 'backdoor' privilege escalation where a standard role is granted administrative powers (e.g., Debugging or System Table access) via PFCG."
    severity = "Critical"
    tactic = "TA0004"
    technique = "T1098"

  events:
    $change.metadata.log_type = "SAP_CHANGE_DOCUMENT"
    $change.target.resource.attribute.labels["TABNAME"] = "CD1251"
    $change.target.resource.attribute.labels["CHNGIND"] = /J|U/
    $change.target.application = "PFCG"

    $role = $change.target.resource.product_object_id
    $admin = $change.principal.user.userid

    $auth_object = re.capture($change.target.resource.attribute.labels["TABKEY"], "^.{33}(.{10})")

  match:
    $admin, $role over 1h

  outcome:
    $admin_user = array_distinct($admin)
    $modified_role = array_distinct($role)
    $impacted_object = array_distinct($auth_object)
    $new_value = array_distinct($change.additional.fields["VALUE_NEW"])
    $system_id = array_distinct($change.target.application)
    $risk_score = 75

  condition:
    $change
}