Data Source: Windows Application Event Logs | Detection.FYI

Potential SQL Injection Against Microsoft SQL Server

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Initial Access Data Source: Windows Application Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Rule Type: ES|QL Platform: Windows ·
Share on:

Identifies potential SQL injection attempts against Microsoft SQL Server by detecting obfuscated T-SQL patterns in SQL Server Audit events. Attackers use CHAR concatenation, CONVERT-based subqueries, and CASE/UNION constructs to bypass input validation and extract data or execute unauthorized statements.

Read More
Quick Assist Full Control Sharing Mode Enabled

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Data Source: Windows Application Event Logs Resources: Investigation Guide Noise: Unknown Performance: Normal Threat: Remote Management Tool Abuse Rule Type: Custom Query (KQL) Platform: Windows ·
Share on:

Identifies when Microsoft Quick Assist sharing mode is set to FullControl on a Windows host. This grants the remote helper full interactive control of the target device and may indicate IT help desk fraud, unauthorized remote access, or lateral movement preparation.

Read More