Detectionhightest
MSSQL XPCmdshell Suspicious Execution
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Tue Jul 12Updated Wed Jun 267f103213-a04e-4d59-8261-213dddf22314windows
Log Source
Windowsapplication
ProductWindows← raw: windows
Serviceapplication← raw: application
Definition
Requirements: MSSQL audit policy to monitor for "xp_cmdshell" must be enabled in order to receive this event in the application log (Follow this tutorial https://dba.stackexchange.com/questions/103183/is-there-any-way-to-monitor-execution-of-xp-cmdshell-in-sql-server-2012)
Detection Logic
Detection Logic1 selector
detection:
selection:
Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
EventID: 33205
Data|contains|all:
# You can modify this to include specific commands
- 'object_name:xp_cmdshell'
- 'statement:EXEC'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
7f103213-a04e-4d59-8261-213dddf22314
Status
test
Level
high
Type
Detection
Created
Tue Jul 12
Modified
Wed Jun 26
Path
rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml
Raw Tags
attack.execution