MSSQL Server Failed Logon From External Network — Detection Rule

Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Read the full analysis on IntelFusions