Potential Conti Ransomware Database Dumping Activity Via SQLCmd
Detects the execution of `sqlcmd.exe` with command-line arguments indicative of database enumeration or backup activities, specifically targeting common system databases and processes. This pattern has been associated with Conti ransomware for dumping database contents.
Sigma
