Cross-source coverage
T1505.001 / ATT&CK
Server Software Component: SQL Stored Procedures
11 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).
Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers. To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.
Microsoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any.NET framework language (e.g. VB.NET, C#, etc.). Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.
- Tactics
- Persistence
- Platforms
- Windows · Linux
- Telemetry
-
WinEventLog:ApplicationWinEventLog:Sysmonauditd:SYSCALLApplicationLogs:SQL
How MITRE says to detect it DET0181
Detection Strategy for SQL Stored Procedures Abuse via T1505.001
Windows Analytic 0511
Creation or modification of stored procedures invoking xp_cmdshell or CLR assemblies for command execution and persistence.
WinEventLog:ApplicationStored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditingWinEventLog:SysmonEventCode=1WinEventLog:ApplicationCLR Assembly creation, loading, or modification logs via MSSQL CLR integration
Linux Analytic 0512
SQL stored procedures that invoke OS-level commands via `xp_cmdshell` equivalent or via UDF (User-Defined Functions) mechanisms.
auditd:SYSCALLexecveApplicationLogs:SQLStored procedure creation or modification with shell invocation (e.g., system(), exec())
splunk/security_content
6 rules| Detection | Severity | Format |
|---|---|---|
| Windows SQL Server Configuration Option Hunt | Undefined | SPL |
| Windows SQL Server Critical Procedures Enabled | Undefined | SPL |
| Windows SQL Server Extended Procedure DLL Loading Hunt | Undefined | SPL |
| Windows SQL Server Startup Procedure | Undefined | SPL |
| Windows SQL Server xp_cmdshell Config Change | Undefined | SPL |
| Windows Sqlservr Spawning Shell | Undefined | SPL |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader | High | Sigma |
| Suspicious SQL Query | Medium | Sigma |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| MySQL User-Defined Function Injection | High | Elastic TOML |
| Execution via MSSQL xp_cmdshell Stored Procedure | Medium | Elastic TOML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Potential Remote Code Execution via Database Server | Undefined | Elastic TOML |