MSSQL XPCmdshell Option Change

 1title: MSSQL XPCmdshell Option Change
 2id: d08dd86f-681e-4a00-a92c-1db218754417
 3status: test
 4description: Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed
 5references:
 6    - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
 7    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
 8author: Nasreddine Bencherchali (Nextron Systems)
 9date: 2022/07/12
10tags:
11    - attack.execution
12logsource:
13    product: windows
14    service: application
15    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
16detection:
17    selection:
18        Provider_Name: 'MSSQLSERVER'
19        EventID: 15457
20        Data|contains: 'xp_cmdshell'
21    condition: selection
22falsepositives:
23    - Legitimate enable/disable of the setting
24    - Note that since the event contain the change for both values. This means that this will trigger on both enable and disable
25level: high

References

• Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures

  

  In this blog series, we're planning to take a look at techniques for maintaining access through SQL Server and how they can be detected by security teams.

  
  Read More

• SELECT XMRig FROM SQLServer

  

  In March 2022, we observed an intrusion on a public-facing Microsoft SQL Server. The end goal of this intrusion was to deploy a coin miner. Although deploying a coin miner on a vulnerable server af…

  
  Read More

Related rules

• AMSI Bypass Pattern Assembly GetType
• AWS EC2 Startup Shell Script Change
• Arbitrary Shell Command Execution Via Settingcontent-Ms
• Atlassian Confluence CVE-2022-26134
• Audit CVE Event