MSSQL Server Failed Logon

Title: MSSQL Server Failed Logon
Status: test
Description:Detects failed logon attempts from clients to MSSQL server.
References:
  -https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  -https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
Author: Nasreddine Bencherchali (Nextron Systems), j4son
Date: 2023-10-11
modified:2024-06-26
Tags:

• -'attack.credential-access'
• -'attack.t1110'

Logsource:

• product: windows
• service: application
• definition: Requirements: Must enable MSSQL authentication.

Detection:
  selection:
    Provider_Name|contains: 'MSSQL'
    EventID: '18456'
  condition:selection
Falsepositives:
  -This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them
Level: low