Windows/MSSQL: Detect ALTER SERVER AUDIT or DROP SERVER AUDIT executions
Alerts on MSSQL ALTER/DROP SERVER AUDIT statements that disable or delete server audit coverage.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-13
- Updated
- 2026-07-31
What it detects
This rule identifies attempts to disable or remove SQL Server auditing by matching application log events with EventID 33205 and statements containing either "ALTER SERVER AUDIT" or "DROP SERVER AUDIT". Disabling audit settings can help an attacker reduce visibility into other actions on the server. It relies on Windows application log telemetry that records MSSQL-related provider events including the executed T-SQL statement text.
Reporting behind it
- netspi.comhttps://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-mssql-audit-policy-tampering-via-alter-drop-server-audit-350dfb37
title: "Windows/MSSQL: Detect ALTER SERVER AUDIT or DROP SERVER AUDIT executions"
id: 87a08cc7-00f9-469f-b9ce-b31cf0752b52
status: test
description: This rule identifies attempts to disable or remove SQL Server auditing by matching application log events with EventID 33205 and statements containing either "ALTER SERVER AUDIT" or "DROP SERVER AUDIT". Disabling audit settings can help an attacker reduce visibility into other actions on the server. It relies on Windows application log telemetry that records MSSQL-related provider events including the executed T-SQL statement text.
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-13
modified: 2024-06-26
tags:
- attack.defense-impairment
logsource:
product: windows
service: application
definition: "Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log"
detection:
selection:
Provider_Name|contains: MSSQL
EventID: 33205
Data|contains:
- statement:ALTER SERVER AUDIT
- statement:DROP SERVER AUDIT
condition: selection
falsepositives:
- This event should only fire when an administrator is modifying the audit policy. Which should be a rare occurrence once it's set up
level: high
license: DRL-1.1
related:
- id: 350dfb37-3706-4cdc-9e2e-5e24bc3a46df
type: derived