Possible MSSQL Server Failed Logon (via application)

title: Possible MSSQL Server Failed Logon (via application)
id: 52529f6d-e95b-5c82-a1b4-7cb855735b98
status: stable
description: This rule detects failed logon attempts from clients to MSSQL server.
references:
    - https://attack.mitre.org/techniques/T1110/
    - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
    - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
author: Huntrule Team
date: 2026-01-14
tags:
    - attack.credential-access
    - attack.t1110
logsource:
    product: windows
    service: application
    definition: 'Requirements: Must enable MSSQL authentication.'
detection:
    selection:
        Provider_Name|contains: 'MSSQL'
        EventID: 18456
    condition: selection
falsepositives:
    - Unknown
level: low