detection.wiki

Detection rules › Sigma

SQL Server lateral movement with CLR activation

Status
experimental
Severity
high
Log source
category application, product mssql
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.

Known false positives

  • None

MITRE ATT&CK coverage

TacticTechniques
Persistence

Telemetry coverage

ProviderRecord / event type
MSSQLSERVEREvent ID 15457

Rule body

title: SQL Server lateral movement with CLR activation
description: Detects scenarios where an attacker enables CLR (Common Language Runtime with .NET) to abuse store procedures in order to move lateraly.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505.001-SQL%20Stored%20Procedures
- https://research.nccgroup.com/2021/01/21/mssql-lateral-movement/
- http://www.eventid.net/display-eventid-15457-source-MSSQLSERVER-eventno-9658-phase-1.htm
tags:
- attack.persistence
- attack.t1505.001
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection:
    EventID: 15457
    EventData|contains: '<Data>clr enabled</Data><Data>0</Data><Data>1</Data>' # 0 is for previous status and 1 for new status
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 15457
  EventData|contains: '<Data>clr enabled</Data><Data>0</Data><Data>1</Data>'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventDatamatch
  • <Data>clr enabled</Data><Data>0</Data><Data>1</Data>
field:"EventData" kind:match value:"<Data>clr enabled</Data><Data>0</Data><Data>1</Data>"