Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Flags MSSQLSERVER extended stored procedure events where the message contains 'maggie', indicating potential backdoor usage.

FreeReviewedSigma · High · v5

Product: windows
Service: application
Author: Denis Szadkowski, DIRT / DCSO CyTec (SigmaHQ), DRL 1.1
Published: 2022-10-09
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1546Event Triggered Execution
Priv Esc
- T1546Event Triggered Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of an extended stored procedure execution event where the provider is MSSQLSERVER and the event message contains the string 'maggie'. Attackers may use extended stored procedures to run arbitrary actions within the SQL Server context as a form of persistence or privileged execution. The detection relies on Windows application telemetry reporting EventID 8128 with the relevant provider name and message content.

Reporting behind it

Related detections9 linkedT1546 — drag to rearrange

AdminSDHolder Permissions Changed for Persistence (via security)

Suspicious Persistence via Shell Script Dropped in profile.d Directory (via file_event)

Suspicious Command Processor AutoRun Persistence via Registry Set

Suspicious Python Site Hook or PTH File Written to Site-Packages via File Event

Suspicious MOTD Or Git Hook Script Creation For Linux Persistence

Windows: Suspicious Outlook VbaProject.OTM Macro File Created

Windows: File Creation of Get-Variable.exe in PowerShell WindowsApps Path

Windows process and registry activity matching SOURGUM persistence/privilege escalation behavior

Windows Persistence: Outlook LoadMacroProviderOnBoot Registry Setting Modification

Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'

Pivot detection · T1546 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-mssql-extended-stored-procedure-execution-with-providername-mssqlserver--711ab2fe

title: "Windows MSSQL: Extended Stored Procedure execution with provider name MSSQLSERVER and message containing 'maggie'"
id: 6b9fe1fb-d85e-4e2b-8b61-fffe39059677
status: test
description: This rule identifies execution of an extended stored procedure execution event where the provider is MSSQLSERVER and the event message contains the string 'maggie'. Attackers may use extended stored procedures to run arbitrary actions within the SQL Server context as a form of persistence or privileged execution. The detection relies on Windows application telemetry reporting EventID 8128 with the relevant provider name and message content.
references:
  - https://medium.com/@DCSO_CyTec/mssql-meet-maggie-898773df3b01
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Malware/win_mssql_sp_maggie.yml
author: Denis Szadkowski, DIRT / DCSO CyTec, Huntrule Team
date: 2022-10-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546
  - detection.emerging-threats
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: MSSQLSERVER
    EventID: 8128
    Message|contains: maggie
  condition: selection
falsepositives:
  - Legitimate extended stored procedures named maggie
level: high
license: DRL-1.1
related:
  - id: 711ab2fe-c9ba-4746-8840-5228a58c3cb8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL