1200KM / detection
T1505.001 SQL Stored Procedures — Detection Rules
Detection workspace for T1505.001 SQL Stored Procedures: 1 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Suspicious SQL Query · test · medium · {"category":"database","definition":"Requirements: Must be able to log the SQL queries"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0181 Detection Strategy for SQL Stored Procedures Abuse via T1505.001
AN0511 Analytic 0511
Creation or modification of stored procedures invoking xp_cmdshell or CLR assemblies for command execution and persistence.
AN0512 Analytic 0512
SQL stored procedures that invoke OS-level commands via `xp_cmdshell` equivalent or via UDF (User-Defined Functions) mechanisms.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1505.001 simulation workspace
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.