mdecrevoisier high experimental sigma

SQL Server auditing deactivated

Detects scenarios where an attacker deactivates SQL Server auditing capacities. SQL auditing requires previous configuration on each SQL instance.

View Source

Detection Logic

{
  "sql_server_event": {
    "EventID": 33205
  },
  "server_audit_spec_disabled": {
    "action_id": "AL",
    "class_type": "SA",
    "statement
| contains": "STATE = OFF"
  },
  "server_audit_spec_deleted": {
    "action_id": "DR",
    "class_type": "SA"
  },
  "server_audit_obj_disabled": {
    "action_id": "AL",
    "class_type": "A",
    "statement
| contains": "STATE = OFF"
  },
  "server_audit_obj_deleted": {
    "action_id": "DR",
    "class_type": "A"
  },
  "condition": "sql_server_event and (1 of server_audit_*)"
}

False Positives

⚠ DBA policy change

Field Validations

Loading…

Comments (0)

Loading comments...