3BB: Anomalous Access/Export of FreeRADIUS Credential Database Files
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
Microsoft Sentinel (KQL)
