MSSQL XPCmdshell Option Change
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
Sigma rule (View on GitHub)
1title: MSSQL XPCmdshell Option Change
2id: d08dd86f-681e-4a00-a92c-1db218754417
3status: test
4description: |
5 Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.
6references:
7 - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
8 - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2022-07-12
11modified: 2024-06-26
12tags:
13 - attack.execution
14logsource:
15 product: windows
16 service: application
17 # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
18detection:
19 selection:
20 Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
21 EventID: 15457
22 Data|contains: 'xp_cmdshell'
23 condition: selection
24falsepositives:
25 - Legitimate enable/disable of the setting
26 - Note that since the event contain the change for both values. This means that this will trigger on both enable and disable
27level: high
References
-
In this blog series, we're planning to take a look at techniques for maintaining access through SQL Server and how they can be detected by security teams.
Read More -
In March 2022, we observed an intrusion on a public-facing Microsoft SQL Server. The end goal of this intrusion was to deploy a coin miner. Although deploying a coin miner on a vulnerable server af…
Read More
Related rules
- AADInternals PowerShell Cmdlets Execution - ProccessCreation
- AADInternals PowerShell Cmdlets Execution - PsScript
- AMSI Bypass Pattern Assembly GetType
- APT29 2018 Phishing Campaign CommandLine Indicators
- AWS EC2 Startup Shell Script Change