Detection of PowerShell Execution via Sqlps.exe — Sigma Rule

Rule metadata and linked tags

Author: Agro (@agro_sev) oscd.community. Source status: test; severity: medium. Source dates: 2020-10-10 / 2022-12-09.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 9ae46d519eda615dd3e3390274af8612a0adc9b80c683957683d00bac709bbd5

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Detection of PowerShell Execution via Sqlps.exe
id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
status: test
description: |
  This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
  Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
references:
    - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/
    - https://twitter.com/bryon_/status/975835709587075072
author: 'Agro (@agro_sev) oscd.community'
date: 2020-10-10
modified: 2022-12-09
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1127
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\sqlps.exe'
    selection_image:
        - Image|endswith: '\sqlps.exe'
        - OriginalFileName: 'sqlps.exe'
    filter_image:
        ParentImage|endswith: '\sqlagent.exe'
    condition: selection_parent or (selection_image and not filter_image)
falsepositives:
    - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.
level: medium

Original YAML and metadata in JSON

False positives

• Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.

Source references

• https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
• https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/
• https://twitter.com/bryon_/status/975835709587075072