Windows MSSQL xp_cmdshell Configuration Change (Event ID 15457)

title: Windows MSSQL xp_cmdshell Configuration Change (Event ID 15457)
id: 6ec27776-7ae5-4d06-b1d4-f04a4ae4d5df
status: test
description: This rule identifies changes to the SQL Server xp_cmdshell setting by matching Windows application events where the event ID is 15457 and the event data contains 'xp_cmdshell' under an MSSQL provider. Attackers may enable xp_cmdshell to execute operating system commands from SQL Server, so configuration changes are high-signal telemetry. It relies on Windows application logs containing the MSSQL provider name, EventID 15457, and event data that includes the xp_cmdshell identifier.
references:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2024-06-26
tags:
  - attack.execution
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 15457
    Data|contains: xp_cmdshell
  condition: selection
falsepositives:
  - Legitimate enable/disable of the setting
  - Note that since the event contain the change for both values. This means that this will trigger on both enable and disable
level: high
license: DRL-1.1
related:
  - id: d08dd86f-681e-4a00-a92c-1db218754417
    type: derived