Windows MSSQL xp_cmdshell Execution via EventID 33205

title: Windows MSSQL xp_cmdshell Execution via EventID 33205
id: fc855bcb-a8c7-4b8e-a4a7-884f31dba07b
status: test
description: This rule flags application log events indicating the SQL Server xp_cmdshell stored procedure was used to execute commands. Attackers often leverage xp_cmdshell to run operating system commands from within the database, enabling execution and persistence paths. It relies on Windows application telemetry containing EventID 33205 with event data that includes both the object name xp_cmdshell and a statement indicating EXEC.
references:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2024-06-26
tags:
  - attack.execution
logsource:
  product: windows
  service: application
  definition: 'Requirements: MSSQL audit policy to monitor for "xp_cmdshell" must be enabled in order to receive this event in the application log (Follow this tutorial https://dba.stackexchange.com/questions/103183/is-there-any-way-to-monitor-execution-of-xp-cmdshell-in-sql-server-2012)'
detection:
  selection:
    Provider_Name|contains: MSSQL
    EventID: 33205
    Data|contains|all:
      - object_name:xp_cmdshell
      - statement:EXEC
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7f103213-a04e-4d59-8261-213dddf22314
    type: derived