OpenCanary - MSSQL Login Attempt Via SQLAuth

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•0•31

Detects instances where an MSSQL service on an OpenCanary honeypot has had a login attempt using SQL Authentication. This indicates an adversary is attempting to brute-force or test credentials against the honeypot's emulated MSSQL service.