Windows MSSQL Audit Policy Tampering via ALTER/DROP SERVER AUDIT

title: Windows MSSQL Audit Policy Tampering via ALTER/DROP SERVER AUDIT
id: 87a08cc7-00f9-469f-b9ce-b31cf0752b52
status: test
description: This rule flags application log events from MSSQL where an ALTER SERVER AUDIT or DROP SERVER AUDIT statement is executed. Removing or disabling server audit settings undermines monitoring and can allow attackers to evade forensic visibility. It relies on MSSQL application-log telemetry including EventID 33205 and the statement text in the event data, identifying the audit modification commands.
references:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-13
modified: 2024-06-26
tags:
  - attack.defense-impairment
logsource:
  product: windows
  service: application
  definition: "Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log"
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 33205
    Data|contains:
      - statement:ALTER SERVER AUDIT
      - statement:DROP SERVER AUDIT
  condition: selection
falsepositives:
  - This event should only fire when an administrator is modifying the audit policy. Which should be a rare occurrence once it's set up
level: high
license: DRL-1.1
related:
  - id: 350dfb37-3706-4cdc-9e2e-5e24bc3a46df
    type: derived