MSSQL Extended Stored Procedure Backdoor Maggie Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

This rule detects the execution of the extended stored procedure backdoor named Maggie in the context of Microsoft SQL server by looking for specific event IDs and the string 'maggie' in the event message.