Windows MSSQL Extended Stored Procedure Execution with ProviderName MSSQLSERVER and Message Contains 'maggie'

Flags MSSQLSERVER extended stored procedure events where the message contains 'maggie', indicating potential backdoor usage.

FreeUnreviewedSigmahighv1

windows-mssql-extended-stored-procedure-execution-with-providername-mssqlserver--711ab2fe

title: Windows MSSQL Extended Stored Procedure Execution with ProviderName MSSQLSERVER and Message Contains 'maggie'
id: 6b9fe1fb-d85e-4e2b-8b61-fffe39059677
status: test
description: This rule identifies SQL Server extended stored procedure activity where the provider is MSSQLSERVER and the associated message contains the string "maggie". Such backdoored extended procedure usage can enable persistent access or execution of attacker-controlled code within the database engine context. It relies on Windows application telemetry (EventID 8128) that includes the provider name and a message field searchable for the marker text.
references:
  - https://medium.com/@DCSO_CyTec/mssql-meet-maggie-898773df3b01
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/win_mssql_sp_maggie.yml
author: Denis Szadkowski, DIRT / DCSO CyTec, Huntrule Team
date: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: MSSQLSERVER
    EventID: 8128
    Message|contains: maggie
  condition: selection
falsepositives:
  - Legitimate extended stored procedures named maggie
level: high
license: DRL-1.1
related:
  - id: 711ab2fe-c9ba-4746-8840-5228a58c3cb8
    type: derived

What it detects

This rule identifies SQL Server extended stored procedure activity where the provider is MSSQLSERVER and the associated message contains the string "maggie". Such backdoored extended procedure usage can enable persistent access or execution of attacker-controlled code within the database engine context. It relies on Windows application telemetry (EventID 8128) that includes the provider name and a message field searchable for the marker text.

Known false positives

Legitimate extended stored procedures named maggie

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.