Techniques › T1505 › T1505.001
T1505.001 SQL Stored Procedures
persistence — Windows, Linux · attack.mitre.org · JSON
1
MITRE detection strategy
2
analytics
2
Sigma rules tagged attack.t1505.001
0
KEV CVEs mapped here
<p>Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).</p><p>Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers. To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.</p><p>Microsoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.). Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0181 Detection Strategy for SQL Stored Procedures Abuse via T1505.001 v1.0
AN0511 WindowsCreation or modification of stored procedures invoking xp_cmdshell or CLR assemblies for command execution and persistence.WinEventLog:Application
Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing→ DC0029 Script ExecutionWinEventLog:ApplicationCLR Assembly creation, loading, or modification logs via MSSQL CLR integration→ DC0016 Module LoadTunable:xp_cmdshell_invocation_thresholdCLRAssemblyNameWhitelistTimeWindowAN0512 LinuxSQL stored procedures that invoke OS-level commands viaxp_cmdshellequivalent or via UDF (User-Defined Functions) mechanisms.ApplicationLogs:SQLStored procedure creation or modification with shell invocation (e.g., system(), exec())→ DC0029 Script ExecutionTunable:CommandRegexTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1505.001
Author: Gregory
· 2023-10-11 · logsource: product=windows category=file_event · 9cae055f-e1d2-4f81-b8a5-1986a68cdd84
Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.
Author: @juju4
· 2022-12-27 · logsource: category=database · d84c0ded-edd7-4123-80ed-348bb3ccc4d5
Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields
Rules tagged at the parent level (attack.t1505) 1
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Austin Clark
· 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b
Modifications to a config that will serve an adversary's impacts or persistence