MSSQL XPCmdshell Option Change

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed. This change is often a precursor to adversaries executing operating system commands via SQL Server.