SQL Server - new member added to a server role

title: SQL Server - new member added to a server role
description: Detects scenarios where an attacker adds his account to a server role (sysadmin, securityadmin, serveradmin, ...)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-action-groups-and-actions
- https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles
tags:
- attack.account_manipulation
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: mssql
  category: application
detection:
  selection: # ALTER SERVER ROLE [setupadmin] ADD MEMBER [demo\SQL_user1]
    EventID: 33205
    action_id:
      - APRL # ADD MEMBER
      - ADSP # SERVER_ROLE_MEMBER_CHANGE_GROUP
    class_type: SG # SERVER ROLE
  condition: selection
falsepositives:
- DBA activity
level: medium