SQL Server Spawning Command Shells and Post-Exploitation Steps
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes. Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day. Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert. Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Microsoft Sentinel (KQL)
