detection.wiki

Detection rules › Sigma

SQL Server - new member added to a database role

Status
experimental
Severity
medium
Log source
category application, product mssql
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)

Known false positives

  • DBA activity

MITRE ATT&CK coverage

TacticTechniques
Persistence
Privilege Escalation

Telemetry coverage

ProviderRecord / event type
MSSQLSERVEREvent ID 33205

Rule body

title: SQL Server - new member added to a database role
description: Detects scenarios where an attacker adds his account to a database role (db_securityadmin, db_datawriter, db_securityadmin, ...)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions
- https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles
tags:
- attack.account_manipulation
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection: # ALTER ROLE [db_datareader] ADD MEMBER [DEMO\svc-kasp-db]
    EventID: 33205
    action_id:
      - APRL # ADD MEMBER
      - ADDP # DATABASE_ROLE_MEMBER_CHANGE_GROUP
    class_type: RL # ROLE
  condition: selection
falsepositives:
- DBA activity
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 33205
  action_id:
    - APRL
    - ADDP
  class_type: RL

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
action_ideq
  • ADDP
  • APRL corpus 2 (sigma 2)
field:"action_id" kind:eq
class_typeeq
  • RL
field:"class_type" kind:eq value:"RL"