this event could stem from users changing an account's password that's used to authenticate via a job or an automated process. investigate the source of such events and mitigate them

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml>sigma
technicques: t1110

Techniques

Detects failed logon attempts from clients to MSSQL server.

condition: selection
selection:
  EventID: 18456
  Provider_Name|contains: MSSQL