sap hanadb audit trail policy changes

Severity: high
Time window: 30m
Match by: user
Author: Google Cloud Security
Source: github.com/chronicle/detection-rules

Detects changes to SAP HANA audit policies (Create, Alter, Drop) which could indicate an attempt to evade logging.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Rule body

// Copyright 2026 Google LLC. Licensed under Apache-2.0.

rule sap_hanadb_audit_trail_policy_changes {

  meta:
    author = "Google Cloud Security"
    description = "Detects changes to SAP HANA audit policies (Create, Alter, Drop) which could indicate an attempt to evade logging."
    severity = "High"
    tactic = "TA0005"
    technique = "T1562"

  events:
    $e.metadata.product_name = "SAP_HANA_AUDIT"

    $statement = $e.additional.fields["executed_statement"]
    $statement = /AUDIT\s+POLICY/ nocase

    $user = $e.principal.user.user_display_name

  match:
    $user over 30m

  outcome:
    $risk_score = max(85)
    $principal_user = array_distinct($user)
    $statements = array_distinct($statement)
    $system_id = array_distinct($e.target.resource.attribute.labels["system_id"])
    $policy_name = array_distinct($e.security_result.rule_name)

  condition:
    $e
}

YARA-L rule structure

Condition

Fires when at least one $e event in the 30m window.

Events

`$e`

additional.fields["executed_statement"] matches "AUDIT\s+POLICY"

Match and correlation

Match key: $user
Within: 30m

Outcome

Outcome variables add context to a detection. When the rule generates an alert, $risk_score is displayed with it.

Field	Expression
`risk_score`	`max(85)`
`principal_user`	`array_distinct($user)`
`statements`	`array_distinct($statement)`
`system_id`	`array_distinct($e.target.resource.attribute.labels["system_id"])`
`policy_name`	`array_distinct($e.security_result.rule_name)`