3BB: Anomalous RADIUS Database Dump/Export Outside Backup Jobs
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Microsoft Sentinel (KQL)
