SQL Server xp_cmdshell activation (native event)

Detects scenarios where an attacker enable the xp_cmdshell in order to execute non SQL content and escalate privileges