Menu
Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On'
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-foundations-8-1-7-4The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Showing SKILL.md
| name | cis-azure-foundations-8.1.7.4 |
| description | Ensure That Microsoft Defender for SQL Servers on Machines Is Set To 'On' |
| category | cis-azure-foundations |
| version | 5.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","security","defender","databases","sql-servers"] |
| cis_id | 8.1.7.4 |
| cis_benchmark | CIS Microsoft Azure Foundations Benchmark v5.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Turning on Microsoft Defender for SQL servers on machines enables threat detection for SQL servers on machines, providing threat intelligence, anomaly detection, and behavior analytics in Microsoft Defender for Cloud.
Enabling Microsoft Defender for SQL servers on machines allows for greater defense-in-depth, functionality for discovering and classifying sensitive data, surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database.
Turning on Microsoft Defender for SQL servers on machines incurs an additional cost per resource.
From Azure Portal:
Microsoft Defender for Cloud.Management, select Environment Settings.Defender plans blade.Select types > in the row for Databases.SQL servers on machines is set to On.From Azure CLI:
az security pricing show -n SqlServerVirtualMachines
Ensure the 'PricingTier' is set to 'Standard'.
From PowerShell:
Get-AzSecurityPricing -Name 'SqlServerVirtualMachines' | Select-Object Name,PricingTier
Ensure the 'PricingTier' is set to 'Standard'.
From Azure Policy:
6581d072-105e-4418-827f-bd446d56421b - Name: 'Azure Defender for SQL servers on machines should be enabled'abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9 - Name: 'Azure Defender for SQL should be enabled for unprotected Azure SQL servers'The pricing tier for SqlServerVirtualMachines should be Standard.
From Azure Portal:
Microsoft Defender for Cloud.Management, select Environment Settings.Defender plansSelect types > in the row for Databases.SQL servers on machines to On.Continue.Save.From Azure CLI:
az security pricing create -n SqlServerVirtualMachines --tier 'standard'
From PowerShell:
Set-AzSecurityPricing -Name 'SqlServerVirtualMachines' -PricingTier 'Standard'
By default, Microsoft Defender plan is off.