OmniQuery.pl abused to extract user auth_data from FMC database
Detects the execution of 'OmniQuery.pl' with command-line arguments indicative of direct database queries targeting sensitive authentication data (e.g., SELECT name, auth_data FROM users). This behavior suggests unauthorized access to database credentials or user information.
Microsoft Sentinel (KQL)
