|
| 1 | +--- |
| 2 | +title: "Custom detection rules with advanced hunting: Protecting SAP external OS commands (SAPXPG)" |
| 3 | +description: Learn how to use advanced hunting with Defender for Endpoint to safeguard the SAPXPG mechanism with SAP systems. |
| 4 | +author: emmwalshh |
| 5 | +ms.author: ewalsh |
| 6 | +manager: deniseb |
| 7 | +ms.date: 05/20/2025 |
| 8 | +ms.topic: overview |
| 9 | +ms.service: defender-endpoint |
| 10 | +ms.subservice: ngp |
| 11 | +ms.localizationpriority: medium |
| 12 | +ms.collection: |
| 13 | +ms.custom: |
| 14 | +- partner-contribution |
| 15 | +ms.reviewer: cgardin |
| 16 | +search.appverid: MET150 |
| 17 | +f1.keywords: NOCSH |
| 18 | +audience: ITPro |
| 19 | +--- |
| 20 | + |
| 21 | +# Custom detection rules with advanced hunting: Protecting SAP external OS commands (SAPXPG) |
| 22 | + |
| 23 | +**Applies to:** |
| 24 | + |
| 25 | +- Microsoft Defender for Endpoint for servers |
| 26 | +- Microsoft Defender for Servers Plan 1 or Plan 2 |
| 27 | + |
| 28 | +SAP Systems can execute OS level commands by using `SAPXPG – Transaction Code SM49/SM69`. This article describes how to use advanced hunting with Microsoft Defender for Endpoint to help safeguard the SAPXPG mechanism to protect it from being exploited. The example illustrated in this article features SAP running on Linux; however, the procedure for SAP running on Windows Server is similar. |
| 29 | + |
| 30 | +## Before you begin |
| 31 | + |
| 32 | +Make sure to read the following articles before you begin: |
| 33 | + |
| 34 | +- [Create custom detection rules](/defender-xdr/custom-detection-rules) |
| 35 | +- [SAP Documentation: Starting External Commands and Programs](https://help.sap.com/doc/saphelp_nw73ehp1/7.31.19/en-US/4b/2b2bed365474fee10000000a421937/frameset.htm) |
| 36 | + |
| 37 | +The SAP BASIS Team and the security team should codevelop the solution. The SAP BASIS team doesn't have access to the [Microsoft Defender portal](/defender-xdr/microsoft-365-security-center-mde), and the security team doesn't know the specifics of the SAP Batch Jobs and External Commands. Both teams should work together. |
| 38 | + |
| 39 | +## Recommended implementation sequence |
| 40 | + |
| 41 | +1. The SAP BASIS team identifies and categorizes the external commands and scripts running on all SAP Environments (Dev, QA, PRD). |
| 42 | + |
| 43 | +2. The security team and the SAP BASIS team ensure that Defender for Endpoint is correctly deployed and configured on all SAP servers. For deployment guidance, see the following articles: |
| 44 | + |
| 45 | + - [Deployment guidance for Microsoft Defender for Endpoint on Linux for SAP](https://aka.ms/mde4sap-linux) |
| 46 | + - [Microsoft Defender for Endpoint on Windows Server with SAP](https://aka.ms/mde4sap-windows) |
| 47 | + |
| 48 | +3. The security team identifies all the SAP servers and runs a query for `"InitiatingProcessName" == "sapxpg"`, noting which servers are starting SAPXPG. |
| 49 | + |
| 50 | + We recommended limiting the number of servers running SAPXPG to a minimum, and disallowing SAPXPG on most SAP servers. And, the SAP BASIS team and security team should limit access to the authorization objects and transaction codes for SAPXPG. |
| 51 | + |
| 52 | +4. The SAP BASIS team briefs the security team on any "allowed" utilities, such as `BRTOOLS` (for Oracle customers), `AzCopy` (if used) or other specific utilities for printing or archiving. |
| 53 | + |
| 54 | +5. The security team works with the SAP BASIS team to query SAPXPG commands and parameters. An example query to detect `wget` (which can be used to download malicious payloads) is as follows: |
| 55 | + |
| 56 | + ```kusto |
| 57 | +
|
| 58 | + DeviceProcessEvents |
| 59 | + | where Timestamp >= ago (1d) |
| 60 | + | where (InitiatingProcessFileName == "sapxpg" or InitiatingProcessFileName =="sapxpg.exe") and FileName == "wget" |
| 61 | +
|
| 62 | + // Query shows SAPXPG commands that execute "wget" |
| 63 | +
|
| 64 | + ``` |
| 65 | + |
| 66 | + This query is designed to work on Linux (`sapxpg`) and Windows (`sapxpg.exe`). |
| 67 | + |
| 68 | + Another query/rule design logic is to block SAPXPG from executing any command other than specified allowed commands. In the following query, any command that is not in the set ("cp", "ls", "mkdir") can be alerted or blocked. |
| 69 | + |
| 70 | + ```kusto |
| 71 | + |
| 72 | + DeviceProcessEvents |
| 73 | + | where Timestamp >= ago (1d) |
| 74 | + | where (InitiatingProcessFileName == "sapxpg" or InitiatingProcessFileName =="sapxpg.exe") and FileName !in ("cp", "ls", "mkdir") |
| 75 | +
|
| 76 | + //Query shows SAPXPG commands that execute any command other than "cp" or "mv" or mkdir |
| 77 | +
|
| 78 | + ``` |
| 79 | + |
| 80 | +6. The security team [creates a custom detection rule](/defender-xdr/custom-detection-rules#2-create-new-rule-and-provide-alert-details) to detect suspicious commands. Suspicious commands could include: |
| 81 | + |
| 82 | + - `ncat` |
| 83 | + - `netcat` |
| 84 | + - `socat` |
| 85 | + - `azcopy` |
| 86 | + - `wget` |
| 87 | + - `curl` |
| 88 | + - `echo` |
| 89 | + - `base64` |
| 90 | + - `/dev/tcp` |
| 91 | + - `pwd` |
| 92 | + - `whoami` |
| 93 | + - `chmod +x` |
| 94 | + |
| 95 | +7. The security team deploys the rule to non-production environments. The security team monitors detections, and the SAP BASIS team monitors jobs/interfaces for errors. |
| 96 | + |
| 97 | +8. The security team deploys the rule to production environments. The SAP BASIS team should monitor jobs and interfaces, and the security team should monitor any alerts that are generated. |
| 98 | + |
| 99 | +## Additional information |
| 100 | + |
| 101 | +- To trace SAPXPG using `sapxpg_trace`, see [SAP documentation: Analyzing Problems with External Commands and Programs](https://help.sap.com/doc/saphelp_snc700_ehp01/7.0.1/en-US/4b/272d0ed1341780e10000000a42189c/content.htm?no_cache=true). |
| 102 | + |
| 103 | +- To learn more about advanced hunting, see [Proactively hunt for threats with advanced hunting in Microsoft Defender](/defender-xdr/advanced-hunting-overview). |
| 104 | + |
| 105 | +- To learn more about custom rules, see [Create custom detection rules](/defender-xdr/custom-detection-rules#2-create-new-rule-and-provide-alert-details). |
0 commit comments