Hayabusa medium experimental sigma

MSSQL Destructive Query

Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".

View Source

Detection Logic

{
  "application": {
    "Channel": "Application"
  },
  "selection": {
    "Provider_Name": "MSSQLSERVER$AUDIT",
    "EventID": 33205,
    "Data
| contains": [
      "statement:TRUNCATE TABLE",
      "statement:DROP TABLE",
      "statement:DROP DATABASE"
    ]
  },
  "condition": "application and selection"
}

False Positives

⚠ Legitimate transaction from a sysadmin.

Field Validations

Loading…

Comments (0)

Loading comments...