detection.wiki

Detection rules › Sigma

SQL Server - new member added to a database role

Status
experimental
Severity
medium
Log source
product mssql, category application
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1098 Account Manipulation
Privilege EscalationT1098 Account Manipulation

Event coverage

ProviderEvent
MSSQLSERVEREvent ID 33205

Rule body yaml

title: SQL Server - new member added to a database role
description: Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions
- https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles
tags:
- attack.account_manipulation
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection: # ALTER ROLE [db_datareader] ADD MEMBER [DEMO\svc-kasp-db]
    EventID: 33205
    action_id:
      - APRL # ADD MEMBER
      - ADDP # DATABASE_ROLE_MEMBER_CHANGE_GROUP
    class_type: RL # ROLE
  condition: selection
falsepositives:
- DBA activity
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 33205
  action_id:
    - APRL
    - ADDP
  class_type: RL

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
action_ideq
  • ADDP
  • APRL corpus 2 (sigma 2)
class_typeeq
  • RL