Detect SQL Server spawning a command shell

The assessment demonstrated abuse of xp_cmdshell to execute operating-system commands through Microsoft SQL Server. I addressed and monitored SQL server coverage and built an alert for the parent-child relationship between the SQL Server process and a spawned command shell. This focuses detection on the host execution behaviour associated with the finding.

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL Microsoft Defender XDR SQL Server security SMB enumeration detection Credential exposure hunting Threat hunting Active Directory NTLM authentication

Return to the full story ←

Detect SQL Server spawning a command shell

Viewed history

Ask about my work.