{"name":"DetectMrbMinerMalware","description":"This metric looks for the presence of the MrbMiner malware by checking for an account in sys.sql_logins.","tsql":"SELECT COUNT(*)\r\nFROM sys.sql_logins AS s\r\nWHERE s.[name] = 'Default'\r\nAND PWDCOMPARE('@fg125kjnhn987.', s.password_hash) = 1","instances":true,"databases":{"mode":1},"frequency":300,"metricenabled":true,"alertname":"MrbMiner Malware Detected","alertdescription":"An account has been detected that is associated with the MrbMiner malware.","aboveorbelow":"above","_thresholds_high":{"selected":true,"value":0},"alertenabled":true,"frequency_comment":"seconds (collected every 5 minutes)","rateofchange":false,"_thresholds_medium":{"selected":false},"_thresholds_low":{"selected":false},"collections":1,"targetentitytype":0}