detection.wiki

Detection rules › Splunk

Windows SQL Server Extended Procedure DLL Loading Hunt

Status
production
Group by
dest, dll_category, dll_name, dll_version
Author
Michael Haag, Splunk
Source
github.com/splunk/security_content

This analytic detects when SQL Server loads DLLs to execute extended stored procedures. This is particularly important for security monitoring as it indicates the first-time use or version changes of potentially dangerous procedures like xp_cmdshell, sp_OACreate, and others. While this is a legitimate operation, adversaries may abuse these procedures for execution, discovery, or privilege escalation.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.009 Command and Scripting Interpreter: Cloud API
PersistenceT1505.001 Server Software Component: SQL Stored Procedures

Event coverage

ProviderEvent
MSSQLSERVEREvent ID 8128

Rule body splunk

name: Windows SQL Server Extended Procedure DLL Loading Hunt
id: 182ba99f-2dde-4cdb-8e5c-e3b1e251cb10
version: 4
creation_date: '2025-02-13'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Hunting
description: This analytic detects when SQL Server loads DLLs to execute extended stored procedures. This is particularly important for security monitoring as it indicates the first-time use or version changes of potentially dangerous procedures like xp_cmdshell, sp_OACreate, and others. While this is a legitimate operation, adversaries may abuse these procedures for execution, discovery, or privilege escalation.
data_source:
    - Windows Event Log Application 8128
search: |-
    `wineventlog_application` EventCode=8128
      | rex field=EventData_Xml "<Data>(?<dll_name>[^<]+)</Data><Data>(?<dll_version>[^<]+)</Data><Data>(?<procedure_name>[^<]+)</Data>"
      | rename host as dest
      | eval dll_category=case( dll_name=="xpstar.dll", "Extended Procedures", dll_name=="odsole70.dll", "OLE Automation", dll_name=="xplog70.dll", "Logging Procedures", true(), "Other")
      | stats count as execution_count, values(procedure_name) as procedures_used, latest(_time) as last_seen
        BY dest dll_name dll_category
           dll_version
      | sort - execution_count
      | `windows_sql_server_extended_procedure_dll_loading_hunt_filter`
how_to_implement: To successfully implement this detection, ensure Windows Event Log collection is enabled and collecting from the Application channel. SQL Server must be configured to log to the Windows Application log (enabled by default). The Splunk Windows TA is also required.
known_false_positives: Legitimate administrative activity and normal database operations may trigger this detection. Common false positives include initial database startup and configuration, patch deployment and version updates, regular administrative tasks using extended stored procedures, and application servers that legitimately use OLE automation.
references:
    - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/general-extended-stored-procedures-transact-sql
    - https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms175543(v=sql.105)
    - https://learn.microsoft.com/en-us/sql/relational-databases/extended-stored-procedures-programming/using-extended-stored-procedures
analytic_story:
    - SQL Server Abuse
asset_type: Windows
mitre_attack_id:
    - T1505.001
    - T1059.009
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.001/simulation/dllprocedureload_windows-application.log
          sourcetype: XmlWinEventLog
          source: XmlWinEventLog:Application
      test_type: unit

Stages and Predicates

Stage 1: search

`wineventlog_application` EventCode=8128

Stage 2: rex

| rex field=EventData_Xml "<Data>(?<dll_name>[^<]+)</Data><Data>(?<dll_version>[^<]+)</Data><Data>(?<procedure_name>[^<]+)</Data>"

Stage 3: rename

| rename host as dest

Stage 4: eval

| eval dll_category=case( dll_name=="xpstar.dll", "Extended Procedures", dll_name=="odsole70.dll", "OLE Automation", dll_name=="xplog70.dll", "Logging Procedures", true(), "Other")
dll_category =
if"Extended Procedures"
elif"OLE Automation"
elif"Logging Procedures"
else"Other"

Stage 5: stats

| stats count as execution_count, values(procedure_name) as procedures_used, latest(_time) as last_seen
    BY dest dll_name dll_category
       dll_version

Stage 6: sort

| sort - execution_count

Stage 7: search

| `windows_sql_server_extended_procedure_dll_loading_hunt_filter`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 8128