Detectionhightest
MSSQL SPProcoption Set
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Wed Jul 13Updated Wed Jun 26b3d57a5c-c92e-4b48-9a79-5f124b7cf964windows
Log Source
Windowsapplication
ProductWindows← raw: windows
Serviceapplication← raw: application
Definition
Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log
Detection Logic
Detection Logic1 selector
detection:
selection:
Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
EventID: 33205
Data|contains|all:
- 'object_name:sp_procoption'
- 'statement:EXEC'
condition: selectionFalse Positives
Legitimate use of the feature by administrators (rare)
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
b3d57a5c-c92e-4b48-9a79-5f124b7cf964
Status
test
Level
high
Type
Detection
Created
Wed Jul 13
Modified
Wed Jun 26
Path
rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml
Raw Tags
attack.persistence