SQL Server - Member got new privileges added on a SQL instance level

title: SQL Server - Member got new privileges added on a SQL instance level
description: Detects scenarios where an attacker grants new privileges on a SQL instance level
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions
- https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles
tags:
- attack.account_manipulation
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection: # GRANT ALTER ANY DATABASE TO [DEMO\svc-test]
    EventID: 33205
    action_id:
      - G   # GRANT
      - GWG # GRANT WITH GRANT
    class_type: SR # SERVER
  condition: selection
falsepositives:
- DBA activity
level: medium