SQL Server Dedicated Admin Connection (DAC) mode activated (native)

Status: experimental
Severity: high
Log source: product mssql, service application
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

Known false positives

Admin attempting to debug or recover a SQL Server

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.001` Server Software Component: SQL Stored Procedures

Telemetry coverage

Provider	Record / event type
MSSQLSERVER	Event ID 15457

Rule body

title: SQL Server Dedicated Admin Connection (DAC) mode activated (native)
description: Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.
references:
- https://josephpierini.blogspot.com/2012/07/microsoft-sql-dedicated-admin.html
- https://www.sqlshack.com/sql-server-dedicated-admin-connection-dac-how-to-enable-connect-and-use/
- https://www.mssqltips.com/sqlservertip/1801/enable-sql-server-dedicated-administrator-connection/
- https://docs.microsoft.com/en-us/sql/relational-databases/errors-events/database-engine-events-and-errors?view=sql-server-ver16
tags:
- attack.persistence
- attack.t1505.001
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  service: application
detection:
  selection:
    EventID: 15457
    EventData|contains: '<Data>remote admin connections</Data><Data>0</Data><Data>1</Data>' # 0 is for previous status and 1 for new status
  condition: selection
falsepositives:
- Admin attempting to debug or recover a SQL Server
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 15457
  EventData|contains: '<Data>remote admin connections</Data><Data>0</Data><Data>1</Data>'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`<Data>remote admin connections</Data><Data>0</Data><Data>1</Data>`	`field:"EventData" kind:match value:"<Data>remote admin connections</Data><Data>0</Data><Data>1</Data>"`