2_ds_microsoft_sql_server.md

Use-Case	Event Types/Parsers	MITRE TTP	Content
Cryptomining	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071.001 - Application Layer Protocol: Web Protocols T1496 - Resource Hijacking	3 Rules
Data Access	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1078 - Valid Accounts T1083 - File and Directory Discovery T1213 - Data from Information Repositories	42 Rules 21 Models
Data Exfiltration	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1030 - Data Transfer Size Limits T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage T1568 - Dynamic Resolution	5 Rules 2 Models
Data Leak	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1030 - Data Transfer Size Limits T1071.001 - Application Layer Protocol: Web Protocols T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage	4 Rules 2 Models
Evasion	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071.001 - Application Layer Protocol: Web Protocols T1090.003 - Proxy: Multi-hop Proxy T1090.004 - T1090.004	6 Rules
Lateral Movement	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071.001 - Application Layer Protocol: Web Protocols	4 Rules 2 Models
Malware	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1027 - Obfuscated Files or Information T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1090.003 - Proxy: Multi-hop Proxy T1189 - Drive-by Compromise T1204.001 - T1204.001 T1566.002 - Phishing: Spearphishing Link T1568.002 - Dynamic Resolution: Domain Generation Algorithms	28 Rules 8 Models
Phishing	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071.001 - Application Layer Protocol: Web Protocols T1566.002 - Phishing: Spearphishing Link	3 Rules
Privilege Abuse	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1078 - Valid Accounts	2 Rules
Privileged Activity	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts T1102 - Web Service	4 Rules
Ransomware	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071 - Application Layer Protocol T1071.001 - Application Layer Protocol: Web Protocols T1078 - Valid Accounts	3 Rules
Workforce Protection	database-access ↳cef-mssql-database-login database-failed-login ↳xml-mssql-database-login database-login ↳s-database-login-18454 ↳s-database-login-18453 ↳cef-syslog-microsoft-db-login ↳cef-syslog-microsoft-db-impersonate ↳s-mssql-database-login-xml ↳s-mssql-database-login ↳mssql-database-login ↳cef-microsoft-database-login ↳s-mssql-database-login-1 ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳s-mssql-database-login-failed-xml ↳cef-microsoft-database-failed-login-1 ↳s-mssql-database-login-failed ↳cef-microsoft-database-failed-login ↳xml-mssql-database-login ↳xml-mssql-database-login-1 ↳mssql-database-login-1 ↳s-microsoft-database-login database-query ↳mssql-database-query-3 ↳s-mssql-database-query-sl-xml ↳s-mssql-database-query-al ↳s-mssql-database-query-dl ↳s-mssql-database-query-sl ↳s-mssql-database-query-dl-xml ↳s-mssql-database-query-al-xml ↳mssql-database-query-2 ↳cef-mssql-database-access ↳mssql-database-query-2 failed-app-login ↳s-failed-app-login ↳exalms-sqlserver-failed-login file-read ↳s-microsoft-database-login web-activity-denied ↳cef-microsoft-database-delete	T1071.001 - Application Layer Protocol: Web Protocols	1 Rules