SQL Server - new member added to a database role
Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)
Sigma

Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)

Already have an account?