detection.wiki

Detection rules › Sigma

SQL Server Dedicated Admin Connection (DAC) suspicious activity

Status
stable
Severity
high
Log source
product mssql, service application
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1505.001 Server Software Component: SQL Stored Procedures

Event coverage

ProviderEvent
MSSQLSERVEREvent ID 17199
MSSQLSERVEREvent ID 17200
MSSQLSERVEREvent ID 17201
MSSQLSERVEREvent ID 17202
MSSQLSERVEREvent ID 17810

Rule body yaml

title: SQL Server Dedicated Admin Connection (DAC) suspicious activity
description: Detects scenarios where an attacker enabled the DAC mode in order to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.
references:
- https://josephpierini.blogspot.com/2012/07/microsoft-sql-dedicated-admin.html
- https://www.mssqltips.com/sqlservertip/1801/enable-sql-server-dedicated-administrator-connection/
- https://docs.microsoft.com/en-us/sql/relational-databases/errors-events/database-engine-events-and-errors?view=sql-server-ver16
tags:
- attack.persistence
- attack.t1505.001
author: mdecrevoisier
status: stable
logsource:
  product: mssql
  service: application
detection:
  selection:
    EventID:
      - 17199 # DAC is disabled
      - 17200 # DAC settings changed
      - 17201 # DAC mode enabled to listen on
      - 17202 # DAC connection established
      - 17810 # DAC max connections reached
  condition: selection
falsepositives:
- Admin attempting to debug or recover a SQL Server
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID:
    - 17199
    - 17200
    - 17201
    - 17202
    - 17810