Mass DROP DATABASE Execution with FOREIGN_KEY_CHECKS Bypass Targeting Named Production Schemas
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
Cortex XDR
