SQL Server Engine Process Spawned Suspicious Shell Or LOL Bin

Query

// MSSQL xp_cmdshell / SQL Server Command Execution Detection
let LookBack = 7d;
let SqlEngine = dynamic(["sqlservr.exe", "sqlagent.exe", "sqlagent90.exe"]);
let ShellAndLolbins = dynamic([
"cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe",
"cscript.exe", "rundll32.exe", "regsvr32.exe", "bitsadmin.exe",
"certutil.exe", "curl.exe", "nc.exe", "ncat.exe", "wget.exe",
"python.exe", "python3.exe", "net.exe", "net1.exe", "reg.exe"
]);
let KnownGood = dynamic([
"wmic logicaldisk",					    // Disk monitoring
"haimportdatabasename",					// AlwaysOn / HA rename
"get-foldersize.ps1"					// Maintenance script
]);
DeviceProcessEvents
| where Timestamp > ago(LookBack)
// Match if parent or grandparent process is the SQL engine or SQL agent
| where InitiatingProcessFileName in~ (SqlEngine) or InitiatingProcessParentFileName in~ (SqlEngine)
| where FileName in~ (ShellAndLolbins)
| extend Cmd = tolower(ProcessCommandLine)
| extend IsPwsh = FileName in~ ("powershell.exe", "pwsh.exe")
// Encoded PowerShell: flag -e/-ec/-enc with a long Base64 string to avoid hitting -ExecutionPolicy
| extend SigEncoded  = IsPwsh and Cmd matches regex @"\s-e[a-z]*\s+[a-z0-9+/]{40,}"
| extend SigRevShell = Cmd has_any ("tcpclient", "getstream") or Cmd contains "net.sockets"
| extend SigNetcat   = Cmd contains "nc.exe" or Cmd contains "ncat.exe" or Cmd contains "-e cmd" or Cmd contains "-e powershell"
| extend SigRemoteHta = Cmd contains "mshta" and Cmd has_any ("http://", "https://")
| extend SigDownload = Cmd has_any ("downloadstring", "downloadfile", "bitsadmin", "certutil", "wget") or Cmd contains "invoke-webrequest" or Cmd contains "start-bitstransfer"
| extend SigIex      = (Cmd contains "iex(" or Cmd contains "invoke-expression") and (Cmd contains "http" or Cmd contains "downloadstring")
| extend HighCount = toint(SigEncoded) + toint(SigRevShell) + toint(SigNetcat) + toint(SigRemoteHta) + toint(SigDownload) + toint(SigIex)
// Low-confidence indicators (requires at least 2 matches to trigger)
| extend SigHidden = Cmd contains "-w hidden" or Cmd contains "-windowstyle hidden"
| extend SigRecon  = Cmd has_any ("whoami", "ipconfig", "hostname", "systeminfo") or Cmd contains "net user" or Cmd contains "net localgroup"
| extend LowCount = toint(SigHidden) + toint(SigRecon)
// Filter to keep only actual attack signatures
| where HighCount >= 1 or LowCount >= 2
| extend Indicators = set_difference(pack_array(
    iff(SigEncoded,   "EncodedPowerShell", ""),
    iff(SigRevShell,  "PowerShellReverseShell", ""),
    iff(SigNetcat,    "NetcatShell", ""),
    iff(SigRemoteHta, "RemoteHTA", ""),
    iff(SigDownload,  "RemoteToolDownload", ""),
    iff(SigIex,       "DownloadCradle", ""),
    iff(SigHidden,    "HiddenWindow", ""),
    iff(SigRecon,     "HostRecon", "")
), dynamic([""]))
| extend Verdict = iff(HighCount >= 1,
    "High: SQL engine spawned an attack tool",
    "Suspicious: multiple low-severity indicators, investigation required")
| project
Timestamp,
DeviceName,
SqlServiceAccount  = InitiatingProcessAccountName,
GrandparentProcess = InitiatingProcessParentFileName,
ParentProcess      = InitiatingProcessFileName,
LaunchedProcess    = FileName,
ProcessCommandLine,
Indicators,
Verdict,
DeviceId,
ReportId
| order by Timestamp desc

About this query

Explanation

This query is designed to detect potentially malicious activities involving SQL Server processes. Here's a simplified breakdown of what it does:

Purpose: The query aims to identify when SQL Server processes (sqlservr.exe or sqlagent.exe) start command-line shells or other programs that could be used for malicious purposes, such as PowerShell or command-line interpreters.
Detection Mechanism:
- It looks for processes started by SQL Server that match a list of known command-line tools and interpreters, often used in attacks (e.g., cmd.exe, powershell.exe, mshta.exe).
- It evaluates the command-line arguments of these processes for signs of malicious activity, such as:
  - Encoded PowerShell commands.
  - Reverse shell commands.
  - Remote file downloads.
  - Host reconnaissance commands (e.g., whoami, ipconfig).
Scoring System:
- The query uses a scoring system to classify the detected activities:
  - High-confidence indicators: If any high-confidence malicious patterns are found, the activity is flagged as "High: SQL engine spawned an attack tool."
  - Low-confidence indicators: If multiple low-confidence patterns are detected, it is flagged as "Suspicious: multiple low-severity indicators, investigation required."
Output:
- The query outputs details such as the timestamp, device name, SQL service account, parent and grandparent processes, the launched process, command line used, detected indicators, and a verdict on the activity's nature.
- It orders the results by the most recent timestamp.

Overall, this query helps security teams monitor SQL Server activities for signs of potential attacks or misuse, allowing them to respond promptly to suspicious behavior.