SQL Database Backup or Credential Modification Activity

Collin Lairamore@Bollinmore

•updated Aug 3, 2026•1•0•4

Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.