All Detections

SQL Server auditing deactivated

SIGMA Detection Rules@SIGMADetectionRules
updated Sep 6, 202507

Detects scenarios where an attacker deactivates SQL Server auditing capacities. SQL auditing requires previous configuration on each SQL instance.

Sigma