Metasploit reverse shell injection in SQL Server

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker inject a payload into SQL Server in order to obtain a remote shell.

Known false positives

none

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.003` Command and Scripting Interpreter: Windows Command Shell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Metasploit reverse shell injection in SQL Server
description: Detects scenarios where an attacker inject a payload into SQL Server in order to obtain a remote shell.
references:
- https://www.offensive-security.com/metasploit-unleashed/payloads-mssql/#
tags:
- attack.execution
- attack.t1059.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    #Version: 2  # applies to ID 4688 where parent process name is available starting Windows 10 / Server 2016 and higher
    ParentProcessName|endswith: '\sqlservr.exe'
    NewProcessName|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe # PowerShell v6
    CommandLine|contains|all:
      - cmd
      - echo
    CommandLine|contains:
      - /c
      - -c
  condition: selection
falsepositives:
- none
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  ParentProcessName|endswith: '\sqlservr.exe'
  NewProcessName|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  CommandLine|contains|all:
    - cmd
    - echo
  CommandLine|contains:
    - /c
    - -c

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-c` corpus 7 (sigma 6, splunk 1) `/c` corpus 15 (sigma 13, splunk 2) `cmd` corpus 8 (sigma 8) `echo` corpus 9 (sigma 4, splunk 4, elastic 1)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\cmd.exe` corpus 130 (sigma 130) `\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`ParentProcessName`	ends_with	`\sqlservr.exe`	`field:"parent_process_name" kind:ends_with value:"\sqlservr.exe"`

Metasploit reverse shell injection in SQL Server

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`