Detection rules › Sigma

SQL SA admin user enabled

Status
experimental
Severity
high
Log source
category application, product mssql
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.

Known false positives

  • Recovery situations

MITRE ATT&CK coverage

TacticTechniques
Persistence

Telemetry coverage

ProviderRecord / event type
MSSQLSERVEREvent ID 33205

Rule body

title: SQL SA admin user enabled
description: Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1136-Create%20account
- https://www.stigviewer.com/stig/microsoft_sql_server_2012_database_instance/2017-12-01/finding/V-40936
- https://www.ultimatewindowssecurity.com/sqlserver/auditlog/sampleevent.aspx
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-2017
- https://www.sqlshack.com/various-techniques-to-audit-sql-server-databases/
- https://sqlquantumleap.com/reference/server-audit-filter-values-for-action_id/
tags:
- attack.persistence
- attack.t1136
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection:
    EventID: 33205
    action_id: LGEA # Enable
    class_type: SL  # SQL login
    object_name: sa # Default account
  condition: selection
falsepositives:
- Recovery situations
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 33205
  action_id: LGEA
  class_type: SL
  object_name: sa

Indicators

These rows show field, operator, and value matches.