SQL Account Creation with Password

Detects SQL statements that create database user accounts or logins with embedded passwords, covering SQL Server CREATE LOGIN, MySQL CREATE USER IDENTIFIED BY, and PostgreSQL CREATE USER WITH PASSWORD. Mirrors Snaffler rule KeepSqlAccountCreation.

Type

regex

Engine

boost_regex

Confidence

high

Confidence justification

High confidence: the combination of SQL account-creation keywords and an explicit password clause is highly specific to credential-bearing SQL scripts. DDL without password clauses (CREATE TABLE, CREATE INDEX) does not match.

Jurisdictions

global

Regulations

Criminal Code Act 1995 (Cth)

Frameworks

CIS Controls, ISO 27001, NIST CSF

Data categories

credentials

Scope

specific

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

CREATE\s+(?:USER|LOGIN)\s+[\s\S]{0,200}(?:IDENTIFIED\s+BY|WITH\s+PASSWORD)

Corroborative evidence keywords

GRANT, ALTER LOGIN, sp_addlogin, sysadmin

Proximity: 300 characters

Should match

• CREATE USER audit_reader WITH PASSWORD — Exact 65 probe - account/password clause candidate without a populated value
• CREATE USER 'app'@'%' IDENTIFIED BY 'p4ssWord9'; — Exact 75 probe - populated MySQL account password statement
• CREATE LOGIN svc_app WITH PASSWORD = 'S3rv1ce!2024'; ALTER SERVER ROLE sysadmin ADD MEMBER svc_app; — Exact 85 probe - populated login plus independent privileged-role grant
• CREATE USER etl_user WITH PASSWORD 'Etl$ecret2024'; — Populated PostgreSQL account statement at the balanced tier

Should not match

• CREATE TABLE Users (id INT, name VARCHAR(50)); — DDL table creation, no password clause
• CREATE INDEX idx_login ON users(login); — Index DDL, not account creation
• ALTER USER app IDENTIFIED BY 'N3wPassword'; — Sibling account-alter statement is outside this creation detector
• CREATE USER app WITH PASSWORD = ''; — Empty password value remains discovery-only and cannot enforce
• Documentation example: CREATE LOGIN demo WITH PASSWORD = 'S3rv1ce!2024'; ALTER SERVER ROLE sysadmin ADD MEMBER demo; — Documentation example with a full privileged statement is excluded

Known false positives

• SQL migration scripts or database setup documentation that include CREATE USER statements with placeholder or masked passwords for illustrative purposes. Mitigation: Require proximity to operational SQL keywords (GRANT, ALTER LOGIN, sp_addlogin) that indicate production-grade credential scripts rather than documentation.
• ORM or framework generated SQL in test fixtures that creates test accounts with known weak passwords. Mitigation: Template exclusion keywords at 65-tier catch common test/example/placeholder markers.

Collections

• Snaffler Parity — Credential & Secret Files