mdecrevoisier high experimental sigma

SQL Server database auditing deactivated

Detects scenarios where an attacker deactivates SQL Server database auditing capacities. SQL auditing requires previous configuration on each SQL instance.

View Source

Detection Logic

{
  "sql_server_event": {
    "EventID": 33205
  },
  "database_audit_spec_disable": {
    "action_id": "AL",
    "class_type": "DA",
    "statement
| contains": "STATE = OFF"
  },
  "database_audit_spec_delete": {
    "action_id": "DR",
    "class_type": "DA"
  },
  "condition": "sql_server_event and (database_audit_spec_disable or database_audit_spec_delete)"
}

False Positives

⚠ DBA policy change

Field Validations

Loading…

Comments (0)

Loading comments...