ATT&CK technique
View on MITRE ATT&CK →
T1505.001
SQL Stored Procedures
Persistence
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Execution via MSSQL xp_cmdshell Stored Procedure | production | 2026-10-05 |
| elastic | MySQL User-Defined Function Injection | production | 2026-09-18 |
| splunk | Windows SQL Server Critical Procedures Enabled | production | 2026-05-13 |
| splunk | Windows SQL Server Extended Procedure DLL Loading Hunt | production | 2026-05-13 |
| splunk | Windows SQL Server xp_cmdshell Config Change | production | 2026-05-13 |
| splunk | Windows Sqlservr Spawning Shell | production | 2026-05-13 |
| splunk | Windows SQL Server Startup Procedure | production | 2026-05-13 |
| splunk | Windows SQL Server Configuration Option Hunt | production | 2026-05-13 |
| sigma | Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader | test | 2023-10-11 |
| sigma | Suspicious SQL Query | test | 2022-12-27 |