detection.wiki

Detection rules › Sigma

SQL Server - Member got new privileges added on a database

Status
experimental
Severity
medium
Log source
category application, product mssql
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker grants new privileges on a database level

Known false positives

  • DBA activity

MITRE ATT&CK coverage

TacticTechniques
Persistence
Privilege Escalation

Telemetry coverage

ProviderRecord / event type
MSSQLSERVEREvent ID 33205

Rule body

title: SQL Server - Member got new privileges added on a database
description: Detects scenarios where an attacker grants new privileges on a database level
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions
- https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles
tags:
- attack.account_manipulation
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection: # GRANT [Privilege] TO [DEMO\svc-netwrix-db]
    EventID: 33205
    action_id:
      - G   # GRANT
      - GWG # GRANT WITH GRANT
    class_type: DB # DATABASE
  condition: selection
falsepositives:
- DBA activity
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 33205
  action_id:
    - G
    - GWG
  class_type: DB

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
action_ideq
  • G corpus 2 (sigma 2)
  • GWG corpus 2 (sigma 2)
field:"action_id" kind:eq
class_typeeq
  • DB
field:"class_type" kind:eq value:"DB"