Sigma rule: MSSQL SPProcoption Set

Rule

Title

MSSQL SPProcoption Set

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-07-13

Modified

2024-06-26

File

rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

Log source

product

windows

service

application

definition

Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log

Detection

selection:
    Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
    EventID: 33205
    Data|contains|all:
        - 'object_name:sp_procoption'
        - 'statement:EXEC'
condition: selection

False positives (as the rule lists them)

• Legitimate use of the feature by administrators (rare)

Tags

• attack.persistence

References

• https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
• https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml