Possible MSSQL Destructive Query (via application)

title: Possible MSSQL Destructive Query (via application)
id: 25f0416f-da20-5d65-9eba-56326683e4fb
status: stable
description: This rule detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
references:
    - https://attack.mitre.org/techniques/T1485/
    - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16
    - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16
    - https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
author: Huntrule Team
date: 2026-07-22
tags:
    - attack.exfiltration
    - attack.impact
    - attack.t1485
logsource:
    product: windows
    service: application
    definition: 'Requirements: MSSQL audit policy must be enabled in order to receive this event (event id 33205)'
detection:
    selection:
        Provider_Name: 'MSSQLSERVER$AUDIT'
        EventID: 33205
        Data|contains:
            - 'statement:TRUNCATE TABLE'
            - 'statement:DROP TABLE'
            - 'statement:DROP DATABASE'
    condition: selection
falsepositives:
    - Unknown
level: medium