Suspicious Child Process Of SQL Server

Severity: high
Author: FPT.EagleEye Team, wagga
Source: upstream

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application
Persistence	`T1505.003` Server Software Component: Web Shell

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection`

or:
Image|endswith: '\bash.exe'
Image|endswith: '\bitsadmin.exe'
Image|endswith: '\cmd.exe'
Image|endswith: '\netstat.exe'
Image|endswith: '\nltest.exe'
Image|endswith: '\ping.exe'
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
Image|endswith: '\regsvr32.exe'
Image|endswith: '\rundll32.exe'
Image|endswith: '\sh.exe'
Image|endswith: '\systeminfo.exe'
Image|endswith: '\tasklist.exe'
Image|endswith: '\wsl.exe'
ParentImage|endswith: '\sqlservr.exe'

Stage 2: `not 1 of filter_optional_datev`

CommandLine|startswith: '"C:\Windows\system32\cmd.exe" '
Image: 'C:\Windows\System32\cmd.exe'
ParentImage|endswith: 'DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe'
ParentImage|startswith: 'C:\Program Files\Microsoft SQL Server\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	starts_with	`"C:\Windows\system32\cmd.exe"`
`Image`	ends_with	`\bash.exe` corpus 17 (sigma 17) `\bitsadmin.exe` corpus 23 (sigma 23) `\cmd.exe` corpus 92 (sigma 92) `\netstat.exe` corpus 5 (sigma 5) `\nltest.exe` corpus 9 (sigma 9) `\ping.exe` corpus 6 (sigma 6) `\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140) `\regsvr32.exe` corpus 57 (sigma 57) `\rundll32.exe` corpus 76 (sigma 76) `\sh.exe` corpus 13 (sigma 13) `\systeminfo.exe` corpus 9 (sigma 9) `\tasklist.exe` corpus 4 (sigma 4) `\wsl.exe` corpus 8 (sigma 8)
`Image`	eq	`C:\Windows\System32\cmd.exe` corpus 3 (sigma 3)
`ParentImage`	ends_with	`DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe` `\sqlservr.exe` corpus 3 (sigma 3)
`ParentImage`	starts_with	`C:\Program Files\Microsoft SQL Server\`