Suspicious Child Process Of SQL Server

Title: Suspicious Child Process Of SQL Server
Status: test
Description:Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.
References:
  -Internal Research
Author: FPT.EagleEye Team, wagga
Date: 2020-12-11
modified:2023-05-04
Tags:

• -'attack.t1505.003'
• -'attack.t1190'
• -'attack.initial-access'
• -'attack.persistence'
• -'attack.privilege-escalation'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      -'\bash.exe'
      -'\bitsadmin.exe'
      -'\cmd.exe'
      -'\netstat.exe'
      -'\nltest.exe'
      -'\ping.exe'
      -'\powershell.exe'
      -'\pwsh.exe'
      -'\regsvr32.exe'
      -'\rundll32.exe'
      -'\sh.exe'
      -'\systeminfo.exe'
      -'\tasklist.exe'
      -'\wsl.exe'

  filter_optional_datev:
    ParentImage|startswith: 'C:\Program Files\Microsoft SQL Server\'
    ParentImage|endswith: 'DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe'
    Image: 'C:\Windows\System32\cmd.exe'
    CommandLine|startswith: '"C:\Windows\system32\cmd.exe" '
  condition:selection and not 1 of filter_optional_*
Falsepositives:
Level: high