{"id":"869b9ca7-9ea2-4a5a-8325-e80e62f75445","title":"Suspicious Child Process Of SQL Server","description":"Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.","author":"FPT.EagleEye Team, wagga","status":"test","level":"high","date":"2020-12-11","modified":"2023-05-04","tags":["attack.t1505.003","attack.t1190","attack.initial-access","attack.persistence","attack.privilege-escalation"],"technique_ids":["T1190","T1505.003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":[],"references":["Internal Research"],"source_path":"rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml","source_sha256":"312c99d3a33647846c3a8bc63c0824649864aeb4c1f7b3d962de8add73bc46bd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Child Process Of SQL Server\nid: 869b9ca7-9ea2-4a5a-8325-e80e62f75445\nrelated:\n    - id: 344482e4-a477-436c-aa70-7536d18a48c7\n      type: obsolete\nstatus: test\ndescription: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.\nreferences:\n    - Internal Research\nauthor: FPT.EagleEye Team, wagga\ndate: 2020-12-11\nmodified: 2023-05-04\ntags:\n    - attack.t1505.003\n    - attack.t1190\n    - attack.initial-access\n    - attack.persistence\n    - attack.privilege-escalation\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\sqlservr.exe'\n        Image|endswith:\n            # You can add other uncommon or suspicious processes\n            - '\\bash.exe'\n            - '\\bitsadmin.exe'\n            - '\\cmd.exe'\n            - '\\netstat.exe'\n            - '\\nltest.exe'\n            - '\\ping.exe'\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\sh.exe'\n            - '\\systeminfo.exe'\n            - '\\tasklist.exe'\n            - '\\wsl.exe'\n    filter_optional_datev:\n        ParentImage|startswith: 'C:\\Program Files\\Microsoft SQL Server\\'\n        ParentImage|endswith: 'DATEV_DBENGINE\\MSSQL\\Binn\\sqlservr.exe'\n        Image: 'C:\\Windows\\System32\\cmd.exe'\n        CommandLine|startswith: '\"C:\\Windows\\system32\\cmd.exe\" '\n    condition: selection and not 1 of filter_optional_*\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"},{"key":"enterprise/T1505.003","id":"T1505.003","name":"Web Shell","page":"techniques/enterprise/T1505.003/"}],"data_path":"data/detection-rules/869b9ca7-9ea2-4a5a-8325-e80e62f75445.json","kind":"sigma"}