detection.wiki

Detection rules › Sigma

Potential Conti Ransomware Database Dumping Activity Via SQLCmd

Status
test
Severity
high
Log source
category process_creation, product windows
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects a command used by conti to dump database

MITRE ATT&CK coverage

TacticTechniques
Collection

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 1: Process creation
Security-AuditingEvent ID 4688: A new process has been created.

Rule body

title: Potential Conti Ransomware Database Dumping Activity Via SQLCmd
id: 2f47f1fd-0901-466e-a770-3b7092834a1b
status: test
description: Detects a command used by conti to dump database
references:
    - https://twitter.com/vxunderground/status/1423336151860002816?s=20 # The leak info not the files itself
    - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
    - https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15
author: frack113
date: 2021-08-16
modified: 2023-05-04
tags:
    - attack.collection
    - attack.t1005
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_tools:
        - Image|endswith: '\sqlcmd.exe'
        - CommandLine|contains:
              - 'sqlcmd '
              - 'sqlcmd.exe'
    selection_svr:
        CommandLine|contains: ' -S localhost '
    selection_query:
        CommandLine|contains:
            - 'sys.sysprocesses'
            - 'master.dbo.sysdatabases'
            - 'BACKUP DATABASE'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_tools

selection_tools:
    - Image|endswith: '\sqlcmd.exe'
    - CommandLine|contains:
          - 'sqlcmd '
          - 'sqlcmd.exe'

Stage 2: selection_svr

selection_svr:
    CommandLine|contains: ' -S localhost '

Stage 3: selection_query

selection_query:
    CommandLine|contains:
        - 'sys.sysprocesses'
        - 'master.dbo.sysdatabases'
        - 'BACKUP DATABASE'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • -S localhost
  • BACKUP DATABASE
  • master.dbo.sysdatabases
  • sqlcmd
  • sqlcmd.exe
  • sys.sysprocesses
field:"CommandLine" kind:match
Imageends_with
  • \sqlcmd.exe corpus 5 (sigma 5)
field:"Image" kind:ends_with value:"\sqlcmd.exe"