MSSQL SPProcoption Set
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Sigma rule (View on GitHub)
1title: MSSQL SPProcoption Set
2id: b3d57a5c-c92e-4b48-9a79-5f124b7cf964
3status: test
4description: Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
5references:
6 - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
7 - https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
8author: Nasreddine Bencherchali (Nextron Systems)
9date: 2022/07/13
10tags:
11 - attack.persistence
12logsource:
13 product: windows
14 service: application
15 definition: MSSQL audit policy to monitor for 'sp_procoption' must be enabled in order to receive this event in the application log
16 # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
17detection:
18 selection:
19 Provider_Name: 'MSSQLSERVER'
20 EventID: 33205
21 Data|contains|all:
22 - 'object_name:sp_procoption'
23 - 'statement:EXEC'
24 condition: selection
25falsepositives:
26 - Legitimate use of the feature by administrators (rare)
27level: high
References
Related rules
- Abuse of Service Permissions to Hide Services Via Set-Service
- Abuse of Service Permissions to Hide Services Via Set-Service - PS
- Account Tampering - Suspicious Failed Logon Reasons
- Added Credentials to Existing Application
- Anydesk Remote Access Software Service Installation