dan21san
fd62c55e47
new: MSSQL Destructive Query --------- Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
title: MSSQL Destructive Query
|
|
id: 00321fee-ca72-4cce-b011-5415af3b9960
|
|
status: experimental
|
|
description: |
|
|
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".
|
|
references:
|
|
- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16
|
|
- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16
|
|
- https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
|
|
author: Daniel Degasperi '@d4ns4n_'
|
|
date: 2025-06-04
|
|
tags:
|
|
- attack.exfiltration
|
|
- attack.impact
|
|
- attack.t1485
|
|
logsource:
|
|
product: windows
|
|
service: application
|
|
definition: 'Requirements: MSSQL audit policy must be enabled in order to receive this event (event id 33205)'
|
|
detection:
|
|
selection:
|
|
Provider_Name: 'MSSQLSERVER$AUDIT'
|
|
EventID: 33205
|
|
Data|contains:
|
|
- 'statement:TRUNCATE TABLE'
|
|
- 'statement:DROP TABLE'
|
|
- 'statement:DROP DATABASE'
|
|
condition: selection
|
|
falsepositives:
|
|
- Legitimate transaction from a sysadmin.
|
|
level: medium
|