MSSQL xp_cmdshell enabled
SQL Server logged configuration event 15457 for xp_cmdshell — the server-level option that lets a database session run operating-system commands as the…
What it detects
SQL Server logged configuration event 15457 for xp_cmdshell — the server-level option that lets a database session run operating-system commands as the SQL Server service account. It ships disabled, and this event fires when someone turns it on (or off) with sp_configure.
Enabling it is the standard pivot from a compromised database to the host: SQL injection or a weak sa password becomes xp_cmdshell 'whoami', then a dropped payload, then lateral movement — all under the SQL service identity, which is often a highly privileged domain account. The matching capture in the benchmark corpus is exactly that sequence.
MITRE ATT&CK mapping
False positives and triage
Some legacy applications and DBA maintenance scripts genuinely use xp_cmdshell, and on those servers the option may be toggled by deployment tooling. Check whether the server is known to need it, and whether the change happened in a maintenance window from an expected login. Read the surrounding Application log: a 15457 that is followed within minutes by command execution, a new login, or a file written by sqlservr.exe is the attack pattern; a 15457 with nothing after it is usually configuration drift worth reverting regardless.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/mssql_xp_cmdshell_enabled.yaml, licensed under the Apache License 2.0.
id: windows.defense_evasion.mssql_xp_cmdshell_enabled
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1505.001, T1059.003]
description: |
SQL Server logged configuration event 15457 for `xp_cmdshell` — the server-level
option that lets a database session run operating-system commands as the SQL
Server service account. It ships disabled, and this event fires when someone
turns it on (or off) with `sp_configure`.
Enabling it is the standard pivot from a compromised database to the host: SQL
injection or a weak `sa` password becomes `xp_cmdshell 'whoami'`, then a dropped
payload, then lateral movement — all under the SQL service identity, which is
often a highly privileged domain account. The matching capture in the benchmark
corpus is exactly that sequence.
match:
provider_contains_any: [MSSQL]
native_event_id: '15457'
raw_message_contains_any: [xp_cmdshell]
correlation_keys: [hostname]
false_positive_guidance: |
Some legacy applications and DBA maintenance scripts genuinely use xp_cmdshell, and
on those servers the option may be toggled by deployment tooling. Check whether the
server is known to need it, and whether the change happened in a maintenance window
from an expected login. Read the surrounding Application log: a 15457 that is
followed within minutes by command execution, a new login, or a file written by
`sqlservr.exe` is the attack pattern; a 15457 with nothing after it is usually
configuration drift worth reverting regardless.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.