MITRE ATT&CKsub-technique

T1505.001 SQL Stored Procedures

Published 2019-12-12 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence
Platforms
Windows, Linux
Version
1.1
Created
2019-12-12

Description

Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted). Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers. To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server. Microsoft SQL Server can enable common language runtime (CLR) integration. With CLR integration enabled, application developers can write stored procedures using any .NET framework language (e.g. VB .NET, C#, etc.). Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1505 Server Software Component technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1045 Code Signing mitigation
  • M1047 Audit mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (2)

  • C0025 2016 Ukraine Electric Power Attack campaign
  • S0603 Stuxnet software (malware)

Referenced by Compliance · mitigates (13)

  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-11 Developer Testing and Evaluation NIST 800-53 control
  • NIST-SI-14 Non-persistence NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-11 Component Authenticity NIST 800-53 control
  • NIST-SR-4 Provenance NIST 800-53 control
  • NIST-SR-5 Acquisition Strategies, Tools, and Methods NIST 800-53 control

References