From f4626a9ee8a43b16e9c06c126bcbaafcd62ec860 Mon Sep 17 00:00:00 2001
From: JPSxzy8 <147696419+JPSxzy8@users.noreply.github.com>
Date: Fri, 12 Jan 2024 12:15:08 +0100
Subject: [PATCH] Predict common Microsoft SQL Server users

---
 data/txt/common-outputs.txt | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/data/txt/common-outputs.txt b/data/txt/common-outputs.txt
index 15651da4e..cfb83983b 100644
--- a/data/txt/common-outputs.txt
+++ b/data/txt/common-outputs.txt
@@ -111,7 +111,22 @@ XDB
 
 # Microsoft SQL Server
 sa
+BUILTIN\Users
+NT SERVICE\SQLWriter
+NT SERVICE\Winmgmt
+NT SERVICE\MSSQLSERVER
+NT Service\MSSQL$SQLEXPRESS
+NT SERVICE\SQLSERVERAGENT
+SQLTELEMETRY$SQLEXPRESS
 
+## https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/principals-database-engine?view=sql-server-ver16#certificate-based-sql-server-logins
+\##MS_SQLResourceSigningCertificate##
+\##MS_SQLReplicationSigningCertificate##
+\##MS_SQLAuthenticatorCertificate##
+\##MS_AgentSigningCertificate##
+\##MS_PolicyEventProcessingLogin##
+\##MS_PolicySigningCertificate##
+\##MS_PolicyTsqlExecutionLogin##
 
 [Passwords]