AN0511
Analytic 0511
Windows
Creation or modification of stored procedures invoking xp_cmdshell or CLR assemblies for command execution and persistence.
WinEventLog:Application
Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing
WinEventLog:Sysmon
EventCode=1
WinEventLog:Application
CLR Assembly creation, loading, or modification logs via MSSQL CLR integration
[xp_cmdshell_invocation_threshold]
Adjust if legitimate procedures use xp_cmdshell often in environment
[CLRAssemblyNameWhitelist]
Organization-defined whitelist of legitimate CLR assemblies
[TimeWindow]
Tune time window to correlate stored procedure creation with process execution
AN0512
Analytic 0512
Linux
SQL stored procedures that invoke OS-level commands via `xp_cmdshell` equivalent or via UDF (User-Defined Functions) mechanisms.
auditd:SYSCALL
execve
ApplicationLogs:SQL
Stored procedure creation or modification with shell invocation (e.g., system(), exec())
[CommandRegex]
Regex used to detect suspicious OS commands via SQL
[TimeWindow]
Window for correlating procedure creation and command execution