Multiple SQL Server Firewall Rule Updates
This rule detects when a single caller successfully updates three or more SQL Server firewall rules within a one-hour window. This behavior could indicate an adversary attempting to open up network access to a SQL database, potentially for data exfiltration, command and control, or further lateral movement.
Microsoft Sentinel (KQL)
