The Sound of Silence: SAP SM49/SM69 and the OS Commands Your SIEM Never Hears

This research shows that SAP external OS commands launched via sapxpg are largely invisible to the SAP Security Audit Log for interactive and RFC paths, while they are captured either in job logs (for scheduled jobs) or by OS-level auditd when properly configured; the report provides concrete detection rules (monitor sapxpg child processes and auditd execve fields), practical deployment guidance (persist audit rules, collect auditd/job logs, restrict execution rights), and remediation steps to improve visibility and auditing.