Windows MSSQL xp_cmdshell Setting Change (EventID 15457)
Flags MSSQL xp_cmdshell setting changes using Windows application EventID 15457 events containing 'xp_cmdshell'.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-12
- Updated
- 2026-07-31
What it detects
This rule identifies changes to the MSSQL xp_cmdshell stored procedure setting by matching Windows application events with EventID 15457 containing the text xp_cmdshell and a provider name that includes MSSQL. Attackers may alter this option to enable command execution through SQL Server for persistence and execution. It relies on application log telemetry that records the provider, the event ID, and event data containing xp_cmdshell.
Reporting behind it
- netspi.comhttps://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- thedfirreport.comhttps://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-mssql-xp-cmdshell-configuration-change-event-id-15457-d08dd86f
title: Windows MSSQL xp_cmdshell Setting Change (EventID 15457)
id: 6ec27776-7ae5-4d06-b1d4-f04a4ae4d5df
status: test
description: This rule identifies changes to the MSSQL xp_cmdshell stored procedure setting by matching Windows application events with EventID 15457 containing the text xp_cmdshell and a provider name that includes MSSQL. Attackers may alter this option to enable command execution through SQL Server for persistence and execution. It relies on application log telemetry that records the provider, the event ID, and event data containing xp_cmdshell.
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2024-06-26
tags:
- attack.execution
logsource:
product: windows
service: application
detection:
selection:
Provider_Name|contains: MSSQL
EventID: 15457
Data|contains: xp_cmdshell
condition: selection
falsepositives:
- Legitimate enable/disable of the setting
- Note that since the event contain the change for both values. This means that this will trigger on both enable and disable
level: high
license: DRL-1.1
related:
- id: d08dd86f-681e-4a00-a92c-1db218754417
type: derived