Detecting Malicious Activity: Unveiling the Secrets of MS-SQL Logging
summary
Detects concrete MS‑SQL abuse patterns by deploying a repeatable 8–12 week audit configuration and simple detections, shipped as SQL scripts and JSON tests on GitHub; finds default logging a “black hole,” instruments server and database audit specs, and validates across tools like Empire, Responder, Metasploit, CrackMapExec, PowerUpSQL and sqlshell. Demonstrates stealing NTLM hashes via dirry, loading remote code via trusted assemblies, and flagging events by event ID 33205; hundreds of servers now run the baseline.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:49SQL Logging in 2024
- 7:32Baseline Monitoring
- 14:35Documentation
- 17:42Testing
- 20:39Detecting
- 22:21Password Hashes
- 25:50Stored Procedures
- 27:28dirry
- 38:06trusted assembly
- 42:44struggles
- 46:57custom application logging
related talks
19mMicrosoft Defender for SQL: Advanced Threat Protection
22mSecure Your Code — Injections and Logging
54m10 Deadly Sins of SQL Server Configuration
36mBeing A Better Defender By Channeling Your Worst Adversary:
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
21mWhat you can do to protect your SQL Server and why it matters
41mUncovering Azure's Silent Threats: A Journey into Cloud Vulnerabilities