
title: Suspicious Shells Spawn by SQL Server
author: FPT.EagleEye Team, wagga
date: 2020/12/11
description: Detects suspicious shell spawn from MSSQL process, this might be sight
  of RCE or SQL Injection
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    ParentImage: '*\sqlservr.exe'
  SELECTION_3:
    Image:
    - '*\cmd.exe'
    - '*\sh.exe'
    - '*\bash.exe'
    - '*\powershell.exe'
    - '*\bitsadmin.exe'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445
level: critical
logsource:
  category: process_creation
  product: windows
modified: 2021/06/27
status: experimental
tags:
- attack.t1100
- attack.t1505.003
- attack.t1190
- attack.initial_access
- attack.persistence
- attack.privilege_escalation
ruletype: SIGMA
