SQL Server Lateral Movement with CLR Activation
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects scenarios where an attacker enables CLR (Common Language Runtime with .NET) to abuse stored procedures in order to move laterally.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_sql_configuration_change" AND (OBJECTNAME contains "clr enabled") select Action1.USERNAME,Action1.MESSAGE,Action1.DOMAIN,Action1.HOSTNAME,Action1.OBJECTNAME,Action1.OLDVALUE,Action1.NEWVALUE
Detection
Execution Mode
Realtime
Log Sources
SQL Server
