Microsoft suggests using Defender for Cloud and Defender for Endpoint to catch SQL injections and suspicious SQLCMD activity, both employed in the observed attack.

SQL Server 2017 is the first cross-platform release of Microsoft’s relational database manager, and runs on Red Hat Enterprise Linux 7.3, Suse Linux Enterprise 12, Ubuntu 16.04, Docker ...