Query: Sigma rule for Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set t
Matching passage: Sigma rule: Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set t. Logsource: windows / application. Rule: title: MSSQL SPProcoption Set id: b3d57a5c-c92e-4b48-9a79-5f124b7cf964 status: test description: Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-13 modified: 2024-06-26 tags: - attack.persistence logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log' detection: selection: Provider_Name|contains: MSSQL EventID: 33205 Data|contains|all: - object_name:sp_procoption - statement:EXEC condition: selection falsepositives: - Legitimate use of the feature by administrators (rare) level: high
Near-miss passage: Sigma rule: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publishe. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft Office Child Process id: 438025f9-5856-4663-83f7-52f878a70a50 related: - id: c27515df-97a9-4162-8a60-dc0eeb51b775 type: derived - id: e1693bc8-7168-4eab-8718-cdcaa68a1738 type: derived - id: 23daeb52-e6eb-493c-8607-c4f0246cb7d8 type: obsolete - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.) references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml - https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html - https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/ author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io date: 2018-04-06 modified: 2023-04-24 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \EQNEDT32.EXE - \EXCEL.EXE - \MSACCESS.EXE - \MSPUB.exe - \ONENOTE.EXE - \POWERPNT.exe - \VISIO.exe - \WINWORD.EXE - \wordpad.exe - \wordview.exe selection_child_processes: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe -