SQL Server Failed Login Attempts "Microl Office"

Asked Jul 13 '17 at 15:27

Active Jul 13 '17 at 15:27

Viewed 21 times

SQL Server has a long history of failed login attempts into the SA user , occuring about 50 times every 10-20 minutes. and Extended Event auditing shows that the client_app_name is "Microl office":

The PID refers to sqlserver.exe.

Incoming remote connections is disabled for this server so it can't be coming from outside the machine...
No firewall rule exist for SQL server so incoming connections are blocked there too
No jobs are attempting to login

Any ideas what else this could be or suggestions?

asked Jul 13 '17 at 15:27

Ahmed

Do you have a user sa? – DavidPostill Jul 13 '17 at 15:32
There is a lot of malware with the company or product name "Microl Office" – DavidPostill Jul 13 '17 at 15:36
@DavidPostill Yes I have a user "sa"... It would seem sqlserver is additionally on that list then since the malware has affected it. – Ahmed Jul 13 '17 at 16:07
More likely is you have malware and it is targeting SQLServer. – DavidPostill Jul 13 '17 at 16:48

SQL Server Failed Login Attempts "Microl Office"

0 Answers0