MSSQL Stored Records Manipulated for Impact
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
Suricata
