Rule Info
Name
MSSQL Destructive Query
Author
Daniel Degasperi '@d4ns4n_'
Description
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
Reference
Date
2025-06-04 00:00:00
Modified
None
Id
00321fee-ca72-4cce-b011-5415af3b9960
Tags
attack.exfiltration attack.impact attack.t1485
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Scan your endpoints, forensic images or collected files with our portable scanner THOR