Skip to content

Update MSSQL Server Failed Logon From External Network to filter for local machine without IP #5440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 31, 2025

Conversation

gregorywychowaniec-zt
Copy link
Contributor

Summary of the Pull Request

Add a filter to win_mssql_failed_logon_from_external_network rule for usage of local_machine value instead of an IP.

Changelog

fix: MSSQL Server Failed Logon From External Network - filter for local_machine without IP

Example Log Event

Some Data fields with this value:

ServiceName,  Reason: Failed to open the explicitly specified database.,  [CLIENT: <local machine>]
USER,  Reason: Could not find a login matching the name provided.,  [CLIENT: <local machine>]
ServiceName,  Reason: Failed to open the database configured in the login object while revalidating the login on the connection.,  [CLIENT: <local machine>]

Fixed Issues

SigmaHQ Rule Creation Conventions

  • If your PR adds new rules, please consider following and applying these conventions

@github-actions github-actions bot added Rules Windows Pull request add/update windows related rules labels May 28, 2025
@phantinuss phantinuss merged commit 3054ad5 into SigmaHQ:master May 31, 2025
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Rules Windows Pull request add/update windows related rules
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants