Windows MSSQL Server Audit: Destructive SQL Statements (DROP/TRUNCATE)

Flags audited MSSQL transactions that include DROP TABLE, DROP DATABASE, or TRUNCATE TABLE.

FreeUnreviewedSigmamediumv1

windows-mssql-server-audit-destructive-sql-statements-drop-truncate-00321fee

title: "Windows MSSQL Server Audit: Destructive SQL Statements (DROP/TRUNCATE)"
id: c13d2eb3-2a49-459b-a24b-0783093ad86d
status: experimental
description: This rule identifies audited MSSQL transaction activity containing destructive DDL statements targeting table or database data, including TRUNCATE TABLE, DROP TABLE, and DROP DATABASE. Such statements can permanently remove or alter data, making them a high-impact action for attackers or misconfigured administrative workflows. It relies on Windows application telemetry from the MSSQLSERVER$AUDIT provider capturing Event ID 33205 and matching specific statement text.
references:
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_destructive_query.yml
author: Daniel Degasperi '@d4ns4n_', Huntrule Team
date: 2025-06-04
tags:
  - attack.exfiltration
  - attack.impact
  - attack.t1485
logsource:
  product: windows
  service: application
  definition: "Requirements: MSSQL audit policy must be enabled in order to receive this event (event id 33205)"
detection:
  selection:
    Provider_Name: MSSQLSERVER$AUDIT
    EventID: 33205
    Data|contains:
      - statement:TRUNCATE TABLE
      - statement:DROP TABLE
      - statement:DROP DATABASE
  condition: selection
falsepositives:
  - Legitimate transaction from a sysadmin.
level: medium
license: DRL-1.1
related:
  - id: 00321fee-ca72-4cce-b011-5415af3b9960
    type: derived

What it detects

This rule identifies audited MSSQL transaction activity containing destructive DDL statements targeting table or database data, including TRUNCATE TABLE, DROP TABLE, and DROP DATABASE. Such statements can permanently remove or alter data, making them a high-impact action for attackers or misconfigured administrative workflows. It relies on Windows application telemetry from the MSSQLSERVER$AUDIT provider capturing Event ID 33205 and matching specific statement text.

Known false positives

Legitimate transaction from a sysadmin.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.