Windows: Suspicious Child Processes Spawned by sqlservr.exe

Alerts when SQL Server (sqlservr.exe) spawns suspicious command/system tools on Windows.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: FPT.EagleEye Team, wagga (SigmaHQ), DRL 1.1
Published: 2020-12-11
Updated: 2026-07-30

ATT&CK techniques

Initial Access → Persistence

Recon
Resource Dev
Initial Access
- T1190Exploit Public-Facing Application
Execution
Persistence
- T1505.003Web Shell
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation events where the parent process is Microsoft SQL Server (sqlservr.exe) and the child process matches a set of commonly used command execution and system interrogation utilities. Such behavior can indicate attempts to establish access, escalate privileges, or leverage SQL Server execution paths for further activity. It relies on process creation telemetry with parent and child image paths and, in one optional case, command-line context to exclude a specific known pattern.

Reporting behind it

Related detections9 linkedT1190 — drag to rearrange

Malicious Web Shell Written to SharePoint LAYOUTS Directory by Worker Process (via file_event)

Malicious Command Shell Spawned by SQL Server via Process Creation (via process_creation)

Possible GoAnywhere MFT Exploitation via Tomcat Spawning Discovery Commands

Suspicious Command Shell Spawned by MSSQL Server Process Indicating Webshell

Malicious MOVEit Transfer Exploitation via X-siLock HTTP Headers (via webserver)

Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell

Suspicious Single-Character Named Executable Launched by Web Server Process (via process_creation)

Malicious MOVEit human2.aspx Web Shell Dropped in wwwroot (via file_event)

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

Windows: Suspicious Child Processes Spawned by sqlservr.exe

Pivot detection · T1190 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-child-processes-spawned-by-sqlservr-exe-869b9ca7

title: "Windows: Suspicious Child Processes Spawned by sqlservr.exe"
id: 8616c9f7-17a7-45e4-a0ee-d2b39b311213
related:
  - id: 344482e4-a477-436c-aa70-7536d18a48c7
    type: obsolete
  - id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445
    type: derived
status: test
description: This rule flags Windows process creation events where the parent process is Microsoft SQL Server (sqlservr.exe) and the child process matches a set of commonly used command execution and system interrogation utilities. Such behavior can indicate attempts to establish access, escalate privileges, or leverage SQL Server execution paths for further activity. It relies on process creation telemetry with parent and child image paths and, in one optional case, command-line context to exclude a specific known pattern.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml
author: FPT.EagleEye Team, wagga, Huntrule Team
date: 2020-12-11
modified: 2023-05-04
tags:
  - attack.t1505.003
  - attack.t1190
  - attack.initial-access
  - attack.persistence
  - attack.privilege-escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sqlservr.exe
    Image|endswith:
      - \bash.exe
      - \bitsadmin.exe
      - \cmd.exe
      - \netstat.exe
      - \nltest.exe
      - \ping.exe
      - \powershell.exe
      - \pwsh.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \sh.exe
      - \systeminfo.exe
      - \tasklist.exe
      - \wsl.exe
  filter_optional_datev:
    ParentImage|startswith: C:\Program Files\Microsoft SQL Server\
    ParentImage|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe
    Image: C:\Windows\System32\cmd.exe
    CommandLine|startswith: '"C:\Windows\system32\cmd.exe" '
  condition: selection and not 1 of filter_optional_*
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL