Vendor: Microsoft

July 25, 2023 · View on GitHub

Product: SQL Server

RulesModelsMITRE TTPsEvent TypesParsers
109381777
Use-CaseEvent Types/ParsersMITRE TTPContent
Abnormal Authentication & Accessdatabase-access
cef-mssql-database-login

database-failed-login
xml-mssql-database-login

database-login
s-database-login-18454
s-database-login-18453
cef-syslog-microsoft-db-login
cef-syslog-microsoft-db-impersonate
s-mssql-database-login-xml
s-mssql-database-login
mssql-database-login
cef-microsoft-database-login
s-mssql-database-login-1
xml-mssql-database-login
xml-mssql-database-login-1
s-mssql-database-login-failed-xml
cef-microsoft-database-failed-login-1
s-mssql-database-login-failed
cef-microsoft-database-failed-login
xml-mssql-database-login
xml-mssql-database-login-1
mssql-database-login-1
s-microsoft-database-login

database-query
mssql-database-query-3
s-mssql-database-query-sl-xml
s-mssql-database-query-al
s-mssql-database-query-dl
s-mssql-database-query-sl
s-mssql-database-query-dl-xml
s-mssql-database-query-al-xml
mssql-database-query-2
cef-mssql-database-access
mssql-database-query-2

failed-app-login
s-failed-app-login
exalms-sqlserver-failed-login

file-read
s-microsoft-database-login

web-activity-denied
cef-microsoft-database-delete
T1071.001 - Application Layer Protocol: Web Protocols
T1133 - External Remote Services
  • 5 Rules
  • 5 Models
Compromised Credentialsdatabase-access
cef-mssql-database-login

database-failed-login
xml-mssql-database-login

database-login
s-database-login-18454
s-database-login-18453
cef-syslog-microsoft-db-login
cef-syslog-microsoft-db-impersonate
s-mssql-database-login-xml
s-mssql-database-login
mssql-database-login
cef-microsoft-database-login
s-mssql-database-login-1
xml-mssql-database-login
xml-mssql-database-login-1
s-mssql-database-login-failed-xml
cef-microsoft-database-failed-login-1
s-mssql-database-login-failed
cef-microsoft-database-failed-login
xml-mssql-database-login
xml-mssql-database-login-1
mssql-database-login-1
s-microsoft-database-login

database-query
mssql-database-query-3
s-mssql-database-query-sl-xml
s-mssql-database-query-al
s-mssql-database-query-dl
s-mssql-database-query-sl
s-mssql-database-query-dl-xml
s-mssql-database-query-al-xml
mssql-database-query-2
cef-mssql-database-access
mssql-database-query-2

failed-app-login
s-failed-app-login
exalms-sqlserver-failed-login

file-read
s-microsoft-database-login

web-activity-denied
cef-microsoft-database-delete
T1003.003 - T1003.003
T1071.001 - Application Layer Protocol: Web Protocols
T1078 - Valid Accounts
T1083 - File and Directory Discovery
T1102 - Web Service
T1189 - Drive-by Compromise
T1204.001 - T1204.001
T1213 - Data from Information Repositories
T1566.002 - Phishing: Spearphishing Link
T1568.002 - Dynamic Resolution: Domain Generation Algorithms
  • 72 Rules
  • 31 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Phishing: Spearphishing Link

External Remote Services

Valid Accounts

Drive-by Compromise

Phishing

User Execution

External Remote Services

Valid Accounts

Valid Accounts

Valid Accounts

Obfuscated Files or Information

OS Credential Dumping

File and Directory Discovery

Data from Information Repositories

Web Service

Application Layer Protocol: Web Protocols

Dynamic Resolution

Dynamic Resolution: Domain Generation Algorithms

Proxy: Multi-hop Proxy

Application Layer Protocol

Proxy

Data Transfer Size Limits

Exfiltration Over Web Service: Exfiltration to Cloud Storage

Exfiltration Over Web Service

Resource Hijacking