All Detections

SQL SA admin user enabled

SIGMA Detection Rules@SIGMADetectionRules
updated Sep 6, 2025026

Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.

Sigma