Windows MSSQL xp_cmdshell Command Execution via Application Event 33205
Alerts when SQL Server xp_cmdshell is invoked to execute commands, using Windows application EventID 33205 data.
FreeReviewedSigma · High · v2
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-12
- Updated
- 2026-07-31
What it detects
This rule identifies use of the MSSQL xp_cmdshell stored procedure by matching application log events with EventID 33205 that contain an EXEC statement targeting object_name xp_cmdshell. xp_cmdshell is a common post-exploitation mechanism because it enables SQL Server to execute operating system commands from within the database context. It relies on Windows application logging that includes MSSQL audit events carrying the xp_cmdshell and EXEC details.
Reporting behind it
- netspi.comhttps://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- thedfirreport.comhttps://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-mssql-xp-cmdshell-execution-via-eventid-33205-7f103213
title: Windows MSSQL xp_cmdshell Command Execution via Application Event 33205
id: fc855bcb-a8c7-4b8e-a4a7-884f31dba07b
status: test
description: This rule identifies use of the MSSQL xp_cmdshell stored procedure by matching application log events with EventID 33205 that contain an EXEC statement targeting object_name xp_cmdshell. xp_cmdshell is a common post-exploitation mechanism because it enables SQL Server to execute operating system commands from within the database context. It relies on Windows application logging that includes MSSQL audit events carrying the xp_cmdshell and EXEC details.
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-12
modified: 2024-06-26
tags:
- attack.execution
logsource:
product: windows
service: application
definition: 'Requirements: MSSQL audit policy to monitor for "xp_cmdshell" must be enabled in order to receive this event in the application log (Follow this tutorial https://dba.stackexchange.com/questions/103183/is-there-any-way-to-monitor-execution-of-xp-cmdshell-in-sql-server-2012)'
detection:
selection:
Provider_Name|contains: MSSQL
EventID: 33205
Data|contains|all:
- object_name:xp_cmdshell
- statement:EXEC
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 7f103213-a04e-4d59-8261-213dddf22314
type: derived