detection.wiki

Detection rules › Splunk

Windows Sqlservr Spawning Shell

Author
Michael Haag, Splunk
Source
upstream

This analytic detects instances where the sqlservr.exe process spawns a command shell (cmd.exe) or PowerShell process. This behavior is often indicative of command execution initiated from within the SQL Server process, potentially due to exploitation of SQL injection vulnerabilities or the use of extended stored procedures like xp_cmdshell.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.001 Server Software Component: SQL Stored Procedures

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: tstats

tstats WHERE (Processes.original_file_name="Cmd.Exe" OR Processes.original_file_name="PowerShell.EXE" OR Processes.original_file_name="powershell_ise.EXE" OR Processes.original_file_name="pwsh.dll" OR Processes.process_name="cmd.exe" OR Processes.process_name="powershell.exe" OR Processes.process_name="powershell_ise.exe" OR Processes.process_name="pwsh.exe") Processes.parent_process_name="sqlservr.exe" BY Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Processes.original_file_nameeq
  • Cmd.Exe corpus 32 (sigma 30, splunk 2)
  • PowerShell.EXE corpus 64 (sigma 60, splunk 4)
  • powershell_ise.EXE corpus 8 (sigma 4, splunk 4)
  • pwsh.dll corpus 72 (sigma 68, splunk 4)
Processes.parent_process_nameeq
  • "sqlservr.exe"
Processes.process_nameeq
  • cmd.exe corpus 2 (splunk 2)
  • powershell.exe corpus 3 (splunk 3)
  • powershell_ise.exe corpus 3 (splunk 3)
  • pwsh.exe corpus 3 (splunk 3)