huntrule

Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Flags MSSQLSERVER extended stored procedure events where the message contains 'maggie', indicating potential backdoor usage.

FreeReviewedSigma · High · v5
Product
windows
Service
application
Author
Denis Szadkowski, DIRT / DCSO CyTec (SigmaHQ), DRL 1.1
Published
2022-10-09
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of an extended stored procedure execution event where the provider is MSSQLSERVER and the event message contains the string 'maggie'. Attackers may use extended stored procedures to run arbitrary actions within the SQL Server context as a form of persistence or privileged execution. The detection relies on Windows application telemetry reporting EventID 8128 with the relevant provider name and message content.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange
AdminSDHolder Permissions Changed for Persistence (via security)
Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)
Suspicious Command Processor AutoRun Persistence via Registry Set
Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event
Suspicious MOTD Or Git Hook Script Creation For Linux Persistence
Windows: Suspicious Outlook VbaProject.OTM Macro File Created
Windows: File Creation of Get-Variable.exe in PowerShell WindowsApps Path
Windows process and registry activity matching SOURGUM persistence/privilege escalation behavior
Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification
Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'
Pivot detection · T1546 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.