Windows MSSQL: Add Member to sysadmin Role (Server Role Alter) EventID 33205

Alerts on MSSQL EventID 33205 when an ALTER SERVER ROLE command adds a member to the sysadmin role.

FreeUnreviewedSigmahighv1

windows-mssql-add-member-to-sysadmin-role-server-role-alter-eventid-33205-08200f85

title: "Windows MSSQL: Add Member to sysadmin Role (Server Role Alter) EventID 33205"
id: 1fc161f3-4b7d-4c80-82d8-cab4c5affb4e
status: test
description: This rule flags MSSQL events where the server role sysadmin is altered to add a new member, which attackers can use to establish persistent administrative access. It matters because adding accounts to sysadmin enables broad control over the SQL Server instance. The detection relies on Windows application log telemetry for MSSQL EventID 33205 and matching the statement text that adds a member to the sysadmin fixed server role.
references:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-13
modified: 2024-06-26
tags:
  - attack.persistence
logsource:
  product: windows
  service: application
  definition: "Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log"
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 33205
    Data|contains|all:
      - object_name:sysadmin
      - "statement:alter server role [sysadmin] add member "
  condition: selection
falsepositives:
  - Rare legitimate administrative activity
level: high
license: DRL-1.1
related:
  - id: 08200f85-2678-463e-9c32-88dce2f073d1
    type: derived

What it detects

This rule flags MSSQL events where the server role sysadmin is altered to add a new member, which attackers can use to establish persistent administrative access. It matters because adding accounts to sysadmin enables broad control over the SQL Server instance. The detection relies on Windows application log telemetry for MSSQL EventID 33205 and matching the statement text that adds a member to the sysadmin fixed server role.

Known false positives

Rare legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.