sap_btp_emergency_administrator_assignment

rule sap_btp_emergency_administrator_assignment {

  meta:
    author = "Google Cloud Security"
    description = "A user was added to a BTP role collection carrying subaccount, directory, or global account administrator rights"
    severity = "High"
    tactic = "TA0004"
    technique = "T1098"

  events:
    $e.metadata.log_type = "SAP_BTP"

    $e.security_result.category_details = "audit.configuration"
    $e.security_result.detection_fields["object_id_crudType"] = "CREATE"
    $e.security_result.detection_fields["object_id_tableName"] = "xs_rolecollection2user"
    (
        $e.security_result.detection_fields["object_id_rolecollection_name"] = "Subaccount Administrator" nocase or
        $e.security_result.detection_fields["object_id_rolecollection_name"] = "Global Account Administrator" nocase or
        $e.security_result.detection_fields["object_id_rolecollection_name"] = "Directory Administrator" nocase
    )

    $user = strings.coalesce($e.principal.user.user_display_name, $e.principal.user.userid)

  match:
    $user over 15m


  outcome:
    $tenant_id = array_distinct($e.security_result.detection_fields["tenant"])
    $org_id = array_distinct($e.security_result.detection_fields["org_id"])
    $role_name = array_distinct($e.security_result.detection_fields["object_id_rolecollection_name"])
    $risk_score = 75

  condition:
    $e
}