Detection rules › Sigma
SQL SA admin user enabled
Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.
Known false positives
- Recovery situations
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| MSSQLSERVER | Event ID 33205 |
Rule body
title: SQL SA admin user enabled
description: Detects scenarios where an attacker enables the disabled (recommended) SA admin account on the SQL Server instance.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1136-Create%20account
- https://www.stigviewer.com/stig/microsoft_sql_server_2012_database_instance/2017-12-01/finding/V-40936
- https://www.ultimatewindowssecurity.com/sqlserver/auditlog/sampleevent.aspx
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions?view=sql-server-2017
- https://www.sqlshack.com/various-techniques-to-audit-sql-server-databases/
- https://sqlquantumleap.com/reference/server-audit-filter-values-for-action_id/
tags:
- attack.persistence
- attack.t1136
author: mdecrevoisier
status: experimental
logsource:
product: mssql
category: application
detection:
selection:
EventID: 33205
action_id: LGEA # Enable
class_type: SL # SQL login
object_name: sa # Default account
condition: selection
falsepositives:
- Recovery situations
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 33205
action_id: LGEA
class_type: SL
object_name: sa
Indicators
These rows show field, operator, and value matches.