Suspicious Child Process Of SQL Server

SIGMA detection rule by FPT.EagleEye Team, wagga · GPL-2.0

Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

title: Suspicious Child Process Of SQL Server
id: e5fef5f3-db95-fac1-d6a8-ebe5cea61016
related:
    - id: 344482e4-a477-436c-aa70-7536d18a48c7
      type: obsolete
    - id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445
      type: derived
status: test
description: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
references:
    - Internal Research
author: FPT.EagleEye Team, wagga
date: 2020-12-11
modified: 2023-05-04
tags:
    - attack.t1505.003
    - attack.t1190
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection:
        ParentProcessName|endswith: \sqlservr.exe
        NewProcessName|endswith:
            # You can add other uncommon or suspicious processes
            - \bash.exe
            - \bitsadmin.exe
            - \cmd.exe
            - \netstat.exe
            - \nltest.exe
            - \ping.exe
            - \powershell.exe
            - \pwsh.exe
            - \regsvr32.exe
            - \rundll32.exe
            - \sh.exe
            - \systeminfo.exe
            - \tasklist.exe
            - \wsl.exe
    filter_optional_datev:
        CommandLine|startswith: '"C:\Windows\system32\cmd.exe" '
        ParentProcessName|startswith: C:\Program Files\Microsoft SQL Server\
        ParentProcessName|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe
        NewProcessName: C:\Windows\System32\cmd.exe
    condition: process_creation and (selection and not 1 of filter_optional_*)
level: high
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bd66ca05-651d-4c36-b853-d4aaea76375a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion