Detectionhightest

MSSQL Add Account To Sysadmin Role

Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Wed Jul 13Updated Wed Jun 2608200f85-2678-463e-9c32-88dce2f073d1windows

Log Source

Windowsapplication

ProductWindows← raw: windows

Serviceapplication← raw: application

Definition

Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log

Detection Logic

detection:
    selection:
        Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
        EventID: 33205
        Data|contains|all:
            - 'object_name:sysadmin'
            - 'statement:alter server role [sysadmin] add member '
    condition: selection