Elastic Defend high stable eql

Suspicious Execution from MSSQL Service

Identifies the execution of suspicious processes from the Windows MSSQL service, this may indicate the use of MSSQL stored procedures such as xp_cmdshell or the exploitation of SQL injection vulnerabilities to execute malicious commands on the host Operating System.

View Source

Detection Logic

process where event.action == "start" and
(
  /* registry or xp_cmdshell stored procedures */
 (process.parent.name : "sqlservr.exe" and
  process.pe.original_file_name in ("cmd.exe", "PowerShell.EXE", "reg.exe")) or

  /* descendant of cmd or powershell */
  (descendant of [process where event.action == "start" and process.pe.original_file_name in ("cmd.exe", "PowerShell.EXE") and
   process.parent.name : "sqlservr.exe"] and not process.executable : "?:\\Windows\\System32\\conhost.exe") or

   /* unsigned child of sqlserv */
  (process.parent.name : "sqlservr.exe" and process.code_signature.trusted != true and
   not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and
   process.code_signature.status != "errorChaining" and
   not process.hash.sha256 : "1a9adfd83a88d80377d9060c7e2857964bf24974eae13447678cedca7da3dba8") or

   (process.parent.name : "sqlservr.exe" and (process.name : "vpnbridge.exe" or process.pe.original_file_name : "vpnbridge.exe")) or

   (process.parent.name : "sqlservr.exe" and
    (process.name : "certutil.exe" or process.pe.original_file_name == "CertUtil.exe") and process.args : "-urlcache") or

   (process.parent.name : "sqlservr.exe" and
    (process.name : "bitsadmin.exe" or process.pe.original_file_name : "bitsadmin.exe") and
    process.command_line : ("*download*", "*transfer*", "*create*", "*addfile*", "*SetNotifyCmdLine*"))
) and
not process.executable :
              ("\\Device\\HarddiskVolume?\\MSSQL12.ITSM\\MSSQL\\Binn\\DatabaseMail.exe",
               "\\Device\\HarddiskVolume?\\MSSQL13.GP\\MSSQL\\Binn\\DatabaseMail.exe",
               "\\Device\\HarddiskVolume?\\MSSQL13.MSSQLSERVER\\MSSQL\\Binn\\DatabaseMail.exe",
               "S:\\MSSQL\\MSSQL13.MSSQLSERVER\\MSSQL\\Binn\\slssqlmaint.exe")

Field Validations

Loading…

Comments (0)

Loading comments...