User added to SQL Server SecurityAdmin Group

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

This hunting query identifies user added in the SecurityAdmin group of SQL Server.

Attribute	Value
Type	Hunting Query
Solution	Microsoft Windows SQL Server Database Audit
ID	363ea6d1-b30d-4a44-b56a-63c3c8a99621
Tactics	Persistence, PrivilegeEscalation
Techniques	T1098, T1078
Required Connectors	AzureMonitor(WindowsEventLogs)
Source	View on GitHub

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries · Back to Microsoft Windows SQL Server Database Audit