huntrule

Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Flags MSSQLSERVER extended stored procedure events where the message contains 'maggie', indicating potential backdoor usage.

FreeReviewedSigma · High · v5
Product
windows
Service
application
Author
Denis Szadkowski, DIRT / DCSO CyTec (SigmaHQ), DRL 1.1
Published
2022-10-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of an extended stored procedure execution event where the provider is MSSQLSERVER and the event message contains the string 'maggie'. Attackers may use extended stored procedures to run arbitrary actions within the SQL Server context as a form of persistence or privileged execution. The detection relies on Windows application telemetry reporting EventID 8128 with the relevant provider name and message content.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange
Suspicious Python Path Configuration Hook Persistence (via file_event)
Suspicious Zsh Persistence via zshrc_aliases Appended to Shell Startup (via process_creation)
Malicious UNC4841 Dropper Deployment to Boot Partition via mknod (via process_creation)
Suspicious NetworkManager Dispatcher Script Persistence
Suspicious APT Or YUM Package Manager Hook Configuration Created
AdminSDHolder Permissions Changed for Persistence (via security)
Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)
Suspicious Command Processor AutoRun Persistence via Registry Set
Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event
Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'
Pivot detection · T1546 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.