Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

Loading detections…

Suspicious Child Process Of SQL Server

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Outside the enterprise matrix

attack.initial-accessattack.persistenceattack.privilege-escalation

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.