Detection rules › Sigma

SQL Server database's table enumeration

Status
experimental
Severity
medium
Time window
5m
Log source
category process_creation, product windows
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enumerate local SQL Server tables (specially Veeam Backup).

Known false positives

  • maintenance script
  • backup process

MITRE ATT&CK coverage

TacticTechniques
Discovery

Telemetry coverage

Rule body

title: SQL Server database's table enumeration
description: Detects scenarios where an attacker attempts to enumerate local SQL Server tables (specially Veeam Backup).
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://blog.checkymander.com/red%20team/veeam/decrypt-veeam-passwords/
tags:
- attack.discovery
- attack.t1518 # Software discovery
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection: # sqlcmd.exe -S localhos\VEEAMSQL2016 -E -Q "use VeeamBackup SELECT top 100 * FROM Ssh_creds;"
    NewProcessName|endswith: '\sqlcmd.exe'
    CommandLine|contains: # specify the database\instance'
      - /S
      - -S
    CommandLine|contains:
      - select
      - use
      - top
      - from
  condition: selection | count() by Computer > 20
  timeframe: 5m
falsepositives:
- maintenance script
- backup process 
level: medium

Stages and Predicates

Stage 0: condition

selection | count() by Computer > 20

Stage 1: selection

selection:
  NewProcessName|endswith: '\sqlcmd.exe'
  CommandLine|contains:
    - /S
    - -S
  CommandLine|contains:
    - select
    - use
    - top
    - from
Threshold
> 20

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • from
  • select corpus 4 (sigma 4)
  • top corpus 2 (sigma 2)
  • use corpus 3 (sigma 2, splunk 1)
field:"CommandLine" kind:match
NewProcessNameends_with
  • \sqlcmd.exe corpus 5 (sigma 5)
field:"Image" kind:ends_with value:"\sqlcmd.exe"