Privilege escalation in an SAP landscape rarely looks like a single alarming action. It's usually a sequence of individually plausible steps that only look suspicious once you connect them. Here's what that sequence tends to look like in practice.
It often starts with a role assignment, not an exploit
The most common escalation path isn't a technical exploit — it's a role or authorization getting assigned to an account that shouldn't have it, often through a legitimate-looking change that slips past a review. Watching role assignment events for unusual scope or timing catches far more than watching for exotic attacks.
Debug and replace access is a classic pivot point
Debug authorizations that allow changing variable values at runtime (the SAP equivalent of 'debug and replace') are powerful and rarely needed by most users. A spike in debug-mode activity from an account that doesn't normally use it is one of the more reliable early signals of an escalation attempt.
Firefighter or emergency access used outside its window
Emergency access accounts exist for a reason, but they're also a common target. Escalation attempts often show up as firefighter access invoked without a corresponding incident, or used well outside the window it was approved for.
Authorization checks quietly bypassed
Some escalation techniques work by exploiting custom code or configuration that skips standard authorization checks. These rarely trigger obvious alerts on their own — they show up as a user performing an action their assigned role shouldn't allow, which only stands out if something is actively comparing actual activity against expected authorization.
The tell is usually the sequence, not the event
A single role change, a single debug session, a single use of emergency access — any one of these alone can be entirely legitimate. What marks an escalation attempt is the combination and order: access granted, then used somewhere unexpected, in a way that doesn't match how that account normally behaves.
Escalation attempts rarely look dramatic in isolation — a role change here, a debug session there. The pattern only becomes obvious when you're watching for the sequence, not just the individual event.