Sigma rule: MSSQL Disable Audit Settings

Rule

Title

MSSQL Disable Audit Settings

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-13

Modified

2024-06-26

File

rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server

Log source

product

windows

service

application

definition

Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log

Detection

selection:
    Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
    EventID: 33205
    Data|contains:
        - 'statement:ALTER SERVER AUDIT'
        - 'statement:DROP SERVER AUDIT'
condition: selection

False positives (as the rule lists them)

• This event should only fire when an administrator is modifying the audit policy. Which should be a rare occurrence once it's set up

Tags

• attack.defense-impairment

References

• https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
• https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
• https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml