Windows MSSQL: Add Member to sysadmin Server Role (EventID 33205)
Alerts on MSSQL EventID 33205 when an ALTER SERVER ROLE command adds a member to the sysadmin role.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-13
- Updated
- 2026-07-31
What it detects
This rule identifies attempts to persist access by altering the MSSQL sysadmin fixed server role to add a member account. Attackers may leverage sysadmin membership to regain control via high-privilege SQL credentials. It relies on Windows application log events with EventID 33205 containing SQL text that targets the sysadmin role and an ALTER SERVER ROLE ... ADD MEMBER statement.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-mssql-add-member-to-sysadmin-role-server-role-alter-eventid-33205-08200f85
title: "Windows MSSQL: Add Member to sysadmin Server Role (EventID 33205)"
id: 1fc161f3-4b7d-4c80-82d8-cab4c5affb4e
status: test
description: This rule identifies attempts to persist access by altering the MSSQL sysadmin fixed server role to add a member account. Attackers may leverage sysadmin membership to regain control via high-privilege SQL credentials. It relies on Windows application log events with EventID 33205 containing SQL text that targets the sysadmin role and an ALTER SERVER ROLE ... ADD MEMBER statement.
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-13
modified: 2024-06-26
tags:
- attack.persistence
logsource:
product: windows
service: application
definition: "Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log"
detection:
selection:
Provider_Name|contains: MSSQL
EventID: 33205
Data|contains|all:
- object_name:sysadmin
- "statement:alter server role [sysadmin] add member "
condition: selection
falsepositives:
- Rare legitimate administrative activity
level: high
license: DRL-1.1
related:
- id: 08200f85-2678-463e-9c32-88dce2f073d1
type: derived