DLL Loaded for Extended Procedures
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects instances when the SQL Server loads DLLs related to extended procedures like xp_cmdshell, which indicate the misuse of the SQL engine to launch OS-level commands.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "sa_sql_dll_loaded_for_extended_procedures" AND (OBJECTNAME contains "xpstar.dll" OR OBJECTNAME contains "odsole70.dll" OR OBJECTNAME contains "xplog70.dll") select Action1.USERNAME,Action1.MESSAGE,Action1.DOMAIN,Action1.HOSTNAME,Action1.OBJECTNAME,Action1.VERSION,Action1.JOBNAME
Detection
Execution Mode
Realtime
Log Sources
SQL Server
