MSSQL sp_procoption startup execution changed via EXEC (EventID 33205)

title: MSSQL sp_procoption startup execution changed via EXEC (EventID 33205)
id: 423a1cf9-6934-45f5-ae95-98da2d36d44b
status: test
description: This rule flags Microsoft SQL Server events where EXEC statements reference sp_procoption, indicating a stored procedure was set or cleared for automatic execution at SQL Server startup. Such configuration changes can create persistence because a procedure marked for startup will run on every instance start. The detection relies on Windows application log telemetry with EventID 33205 and event content that includes object_name:sp_procoption and statement:EXEC from an MSSQL-related provider.
references:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-13
modified: 2024-06-26
tags:
  - attack.persistence
logsource:
  product: windows
  service: application
  definition: 'Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log'
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 33205
    Data|contains|all:
      - object_name:sp_procoption
      - statement:EXEC
  condition: selection
falsepositives:
  - Legitimate use of the feature by administrators (rare)
level: high
license: DRL-1.1
related:
  - id: b3d57a5c-c92e-4b48-9a79-5f124b7cf964
    type: derived