MSSQL xp_cmdshell Suspicious Execution
This rule detects the execution of the 'xp_cmdshell' stored procedure within Microsoft SQL Server. 'xp_cmdshell' allows SQL Server to execute operating system commands directly, which is a common technique used by attackers for privilege escalation, lateral movement, and persistence within a compromised environment. The detection specifically looks for EventID 33205 in the application log, indicating a SQL Server event, and checks for the presence of 'object_name:xp_cmdshell' and 'statement:EXEC' in the event data, confirming the execution of this procedure.
Sigma
