CVE-2019-1068

Sentinel/Defender KQL

DeviceProcessEvents
| where InitiatingProcessFileName =~ "sqlservr.exe"
| where FileName !in ("sqlservr.exe", "sqlagent.exe", "powershell.exe", "cmd.exe") // Bekannte, legitime Prozesse ausschließen
| where ProcessCommandLine contains "-c" or ProcessCommandLine contains "/c" // Typische Shell-Ausführung
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName

Splunk SPL

index=* sourcetype=WinEventLog:Security EventCode=4688 (ParentProcessName="sqlservr.exe" OR ParentProcessName="sqlagent.exe") NOT (NewProcessName="sqlservr.exe" OR NewProcessName="sqlagent.exe" OR NewProcessName="powershell.exe" OR NewProcessName="cmd.exe") | table _time, host, ParentProcessName, NewProcessName, CommandLine

Sigma

title: SQL Server RCE via Unusual Process Creation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\sqlservr.exe'
    Image|endswith:
      - '.exe'
    Image|contains:
      - 'powershell.exe'
      - 'cmd.exe'
      - 'wscript.exe'
      - 'cscript.exe'
      - 'mshta.exe'
      - 'regsvr32.exe'
      - 'rundll32.exe'
    CommandLine|contains:
      - '-c'
      - '/c'
  condition: selection
falsepositives:
  - Legitimate SQL Server operations (requires tuning based on environment)
level: high

Elastic ES|QL

from process where event.category == "process" and event.type == "start" and process.parent.executable == "sqlservr.exe" and process.executable != "sqlservr.exe" and process.executable != "sqlagent.exe" and process.command_line : ("-c", "/c")