SQL Server started in single mode (command)

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker starts SQL Server service in single mode to perform password recovery actions using, for example, the native sqlcmd tool. Indeed, when the SQL Server is started in single user mode, all the users who are a member of the host’s local administrator group can connect to the SQL instance.

Known false positives

Master database restore procedure
Maintenance operation
Legitim SA account password recovery

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1505.001` Server Software Component: SQL Stored Procedures

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: SQL Server started in single mode (command)
description: Detects scenarios where an attacker starts SQL Server service in single mode to perform password recovery actions using, for example, the native sqlcmd tool. Indeed, when the SQL Server is started in single user mode, all the users who are a member of the host’s local administrator group can connect to the SQL instance.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505.001-SQL%20Stored%20Procedures
- https://www.sqlshack.com/different-ways-to-start-a-sql-server-single-user-mode/
- https://www.sqlshack.com/recover-lost-sa-password/
tags:
- attack.persistence
- attack.t1505.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # full command example: "C:\Windows\system32\net.exe" start MSSQL$INSTANCE /m"
  selection:
    EventID: 4688
    NewProcessName|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains|all:
      - start
      - MSSQL$
    CommandLine|contains: # indicate single mode
      - /m
      - -m
  condition: selection
falsepositives:
- Master database restore procedure
- Maintenance operation
- Legitim SA account password recovery
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  NewProcessName|endswith:
    - \net1.exe
    - \net.exe
  CommandLine|contains|all:
    - start
    - MSSQL$
  CommandLine|contains:
    - /m
    - -m

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-m` corpus 2 (sigma 2) `/m` `MSSQL$` `start` corpus 13 (sigma 11, splunk 2)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\net.exe` corpus 49 (sigma 49) `\net1.exe` corpus 47 (sigma 47)	`field:"Image" kind:ends_with`