OpenCanary - MSSQL Windows Authentication Login Attempt

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•0•23

Detects instances where an MSSQL service on an OpenCanary honeypot node has had a login attempt using Windows Authentication. This indicates an adversary is attempting to authenticate against a honeypot, which is highly suspicious.