MSSQL sp_procoption Startup Execution Set/Clear via Application Log EventID 33205
Alerts on MSSQL sp_procoption being set or cleared for automatic startup execution via EXEC (EventID 33205).
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-13
- Updated
- 2026-07-31
What it detects
This rule identifies MSSQL changes to stored procedure startup execution by matching application log events for sp_procoption statements executed with the EXEC keyword. Setting a procedure to automatic execution causes it to run on SQL Server startup, which can provide persistence for malicious code. It relies on Windows application log telemetry with MSSQL provider naming and EventID 33205 that includes object_name:sp_procoption and statement:EXEC.
Reporting behind it
- netspi.comhttps://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
mssql-sp-procoption-startup-execution-changed-via-exec-eventid-33205-b3d57a5c
title: MSSQL sp_procoption Startup Execution Set/Clear via Application Log EventID 33205
id: 423a1cf9-6934-45f5-ae95-98da2d36d44b
status: test
description: This rule identifies MSSQL changes to stored procedure startup execution by matching application log events for sp_procoption statements executed with the EXEC keyword. Setting a procedure to automatic execution causes it to run on SQL Server startup, which can provide persistence for malicious code. It relies on Windows application log telemetry with MSSQL provider naming and EventID 33205 that includes object_name:sp_procoption and statement:EXEC.
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-13
modified: 2024-06-26
tags:
- attack.persistence
logsource:
product: windows
service: application
definition: 'Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log'
detection:
selection:
Provider_Name|contains: MSSQL
EventID: 33205
Data|contains|all:
- object_name:sp_procoption
- statement:EXEC
condition: selection
falsepositives:
- Legitimate use of the feature by administrators (rare)
level: high
license: DRL-1.1
related:
- id: b3d57a5c-c92e-4b48-9a79-5f124b7cf964
type: derived