CVE-2026-66819

Sentinel/Defender KQL

SecurityEvent
| where EventID == 4624 and LogonType == 3 // Successful network logon
| where SubjectUserName has_any ("sql", "mssql", "sa") // Look for SQL-related accounts
| join kind=inner ( 
    DeviceProcessEvents
    | where FileName in ("sqlservr.exe", "sqldumper.exe") // SQL Server processes
    | where ProcessCommandLine has_any ("xp_cmdshell", "sp_oacreate") // Common SQL injection post-exploitation commands
) on DeviceId, InitiatingProcessId == ProcessId
| project TimeGenerated, DeviceName, SubjectUserName, ProcessCommandLine, RemoteIP, RemotePort
| extend ThreatType = "SQL Injection Privilege Escalation Attempt"

Splunk SPL

index=windows sourcetype=WinEventLog:Security EventCode=4624 Logon_Type=3 (User="*sql*" OR User="*mssql*" OR User="*sa*")
| join type=inner ( 
    index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1 Image IN ("*\\sqlservr.exe", "*\\sqldumper.exe") CommandLine IN ("*xp_cmdshell*", "*sp_oacreate*")
) on ComputerName
| table _time, ComputerName, User, CommandLine, IpAddress, DestPort
| eval ThreatType = "SQL Injection Privilege Escalation Attempt"

Sigma

title: SQL Server Privilege Escalation via SQL Injection
id: 00000000-0000-0000-0000-000000000000 # Placeholder, generate a real UUID
status: experimental
description: Detects potential SQL injection leading to privilege escalation in SQL Server by monitoring suspicious command execution from SQL processes.
author: SecBoard
date: 2024/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\sqlservr.exe'
      - '\sqldumper.exe'
    CommandLine|contains:
      - 'xp_cmdshell'
      - 'sp_oacreate'
  condition: selection
level: high

Elastic ES|QL

from security_events
| where event.category == "process"
| where process.executable : ("*\\sqlservr.exe", "*\\sqldumper.exe")
| where process.command_line : ("*xp_cmdshell*", "*sp_oacreate*")
| select @timestamp, host.name, process.executable, process.command_line, user.name
| extend threat.type = "SQL Injection Privilege Escalation Attempt"