Query: detection rule: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
Matching passage: Sigma rule: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of SQL Server id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 related: - id: 344482e4-a477-436c-aa70-7536d18a48c7 type: obsolete status: test description: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection. references: - Internal Research author: FPT.EagleEye Team, wagga date: 2020-12-11 modified: 2023-05-04 tags: - attack.t1505.003 - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sqlservr.exe Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \netstat.exe - \nltest.exe - \ping.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \sh.exe - \systeminfo.exe - \tasklist.exe - \wsl.exe filter_optional_datev: ParentImage|startswith: C:\Program Files\Microsoft SQL Server\ ParentImage|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe Image: C:\Windows\System32\cmd.exe CommandLine|startswith: '"C:\Windows\system32\cmd.exe" ' condition: selection and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active d. Logsource: windows / process_creation. Rule: title: Active Directory Database Snapshot Via ADExplorer id: 9212f354-7775-4e28-9c9f-8f0a4544e664 related: - id: ef61af62-bc74-4f58-b49b-626448227652 type: derived status: test description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 modified: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - OriginalFileName: AdExp - Description: Active Directory Editor - Product: Sysinternals ADExplorer selection_cli: CommandLine|contains: snapshot condition: all of selection_* falsepositives: - Unknown level: medium