mdecrevoisier medium experimental sigma

SQL Server - Connection attempt using a disabled account

Detects scenarios where an attacker attempts authenticate to the database using a disabled user accont

View Source

Detection Logic

{
  "selection_basic": {
    "EventID": 18470
  },
  "selection_advanced": {
    "EventID": 33205,
    "action_id": [
      "LGFL",
      "LGIF"
    ],
    "class_type": "LX",
    "additional_information
| contains": "<state>7</state>"
  },
  "condition": "selection_basic or selection_advanced"
}

False Positives

  • ⚠ Miss configured accounts or scripts

Field Validations

Loading…

Comments (0)

Loading comments...