MSSQL Database DROP Destruction

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to drop a database on an MSSQL server. It specifically looks for the string "DROP DATABASE" in TCP traffic destined for port 1433 (the default MSSQL port). This activity is indicative of data destruction or sabotage.