T1505.001sub-technique of T1505 Server Software Component
SQL Stored Procedures
Windows · Linuxnothing on this site yetT1505.001 on attack.mitre.org
Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
how MITRE says to see it
Detection Strategy for SQL Stored Procedures Abuse via T1505.001
- Creation or modification of stored procedures invoking xp_cmdshell or CLR assemblies for command execution and persistence.
- SQL stored procedures that invoke OS-level commands via `xp_cmdshell` equivalent or via UDF (User-Defined Functions) mechanisms.
what reduces it
- M1045 Code Signing. Ensure all application component binaries are signed by the correct application developers.
- M1026 Privileged Account Management. Do not allow administrator accounts that have permissions to add component software on these services to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1047 Audit. Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.