CVE-2019-1068 IBM QRadar · QRadar

Detect CVE-2019-1068: Microsoft SQL Server Remote Code Execution in IBM QRadar

Detects exploitation attempts and indicators of CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server. The flaw allows an attacker who can submit specially crafted queries to trigger memory corruption in the SQL Server database engine, potentially leading to arbitrary code execution in the context of the SQL Server service account. This detection focuses on anomalous SQL Server process behavior (child processes spawned from sqlservr.exe), suspicious xp_cmdshell / OLE automation usage, malformed query patterns, and failed/unpatched-instance indicators. CVE-2019-1068 is listed on the CISA Known Exploited Vulnerabilities catalog.

MITRE ATT&CK

Tactic
Execution Lateral Movement

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT QIDNAME(qid) AS event, sourceip, destinationip, "Process Name" AS process, "Parent Process Name" AS parent, "Command Line" AS cmdline, username, starttime
FROM events
WHERE LOWER("Parent Process Name") LIKE '%sqlservr.exe'
AND LOWER("Process Name") IN ('cmd.exe','powershell.exe','cscript.exe','wscript.exe','certutil.exe','bitsadmin.exe','rundll32.exe','mshta.exe','regsvr32.exe','net.exe','whoami.exe')
LAST 24 HOURS
critical severity medium confidence

AQL query returning process-creation events where sqlservr.exe is the parent of a shell or LOLBin, a post-exploitation indicator for CVE-2019-1068.

Data Sources

Windows Security Event LogSysmon via WinCollect

Required Tables

events

False Positives & Tuning

  • Authorized xp_cmdshell maintenance activity
  • SQL Agent scheduled OS command jobs
  • Third-party DB agents spawning helper processes

Other platforms for CVE-2019-1068

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1xp_cmdshell process spawn from SQL Server

    Expected signal: Process creation event: sqlservr.exe -> cmd.exe -> whoami.exe with the SQL service account

  2. Test 2PowerShell download cradle via SQL Server

    Expected signal: sqlservr.exe -> powershell.exe with Invoke-WebRequest in the command line

  3. Test 3OLE Automation command execution

    Expected signal: sqlservr.exe -> cmd.exe launched via WScript.Shell OLE object

Last updated: 2026-08-27 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the SQL Server instance version and patch level on the affected host; verify whether the July 2019 update addressing CVE-2019-1068 (KB4505217/KB4505219/KB4505222 depending on version) is installed.
  2. Review the full command line of the child process spawned by sqlservr.exe and determine whether it maps to a known SQL Agent job, maintenance plan, or authorized xp_cmdshell use.
  3. Correlate the SQL Server service account activity around the alert time with authentication logs and SQL error logs for malformed query batches or unexpected logins.
  4. Check whether xp_cmdshell, OLE Automation Procedures, or CLR integration are enabled on the instance via sp_configure.

Containment

  1. Isolate the affected SQL Server host from the network if unauthorized code execution is confirmed.
  2. Disable xp_cmdshell and OLE Automation Procedures on the instance and rotate the SQL Server service account and any SQL logins with elevated privileges.
  3. Block the offending source IP(s) at the firewall and restrict TDS (port 1433/named instances) access to trusted application subnets.

Evidence Collection

  1. Collect SQL Server ERRORLOG files, the default trace, and any XEvent/Extended Events sessions covering the alert window.
  2. Capture the process tree, command lines, and loaded modules for sqlservr.exe and its child processes from EDR telemetry.
  3. Preserve Windows Security/Sysmon event logs, and image memory of the SQL Server host if RCE is confirmed.

Escalation Criteria

  • !Escalate to incident response if sqlservr.exe spawned an interactive shell or downloaded/executed a payload.
  • !Escalate to the vulnerability management owner if the instance is confirmed unpatched for CVE-2019-1068 and internet-reachable.
  • !Escalate to the data-protection team if evidence indicates database exfiltration or credential theft from the SQL host.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >SQL Server ERRORLOG entries showing crashes, stack dumps (.mdmp) or malformed batch execution
  • >sqlservr.exe child-process records in EDR/Sysmon (EventID 1) and Security 4688 logs
  • >sp_configure state for xp_cmdshell and OLE Automation, and SQL Agent job history

Tuning Guidance

Build an allowlist of known-good child processes and command lines produced by legitimate SQL Agent jobs and maintenance plans, then exclude those specific parent-child-cmdline combinations. Where xp_cmdshell is required operationally, scope exclusions to the specific job step accounts and hosts rather than disabling the rule. Prioritize alerts from internet-reachable or unpatched instances.

Hunting Queries

Baselines and surfaces all distinct child processes of sqlservr.exe per host to spot anomalous execution following possible CVE-2019-1068 exploitation.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName =~ "sqlservr.exe" | summarize count() by FileName, DeviceName, InitiatingProcessAccountName | order by count_ desc
Hunting — SPL
spl 
index=* (EventCode=4688 OR EventCode=1) parent_process="*sqlservr.exe" | stats count values(New_Process_Name) as children by host, Account_Name

Atomic Red Team Tests

Test 1 xp_cmdshell process spawn from SQL Server
windows

Enable and invoke xp_cmdshell to simulate OS command execution from the SQL Server engine, producing a cmd.exe child of sqlservr.exe.

Command

powershell 
sqlcmd -S localhost -Q "EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; EXEC xp_cmdshell 'whoami';"

Cleanup

powershell 
sqlcmd -S localhost -Q "EXEC sp_configure 'xp_cmdshell',0; RECONFIGURE; EXEC sp_configure 'show advanced options',0; RECONFIGURE;"

Expected Telemetry

Process creation event: sqlservr.exe -> cmd.exe -> whoami.exe with the SQL service account

Expected Detection

KQL/SPL rules fire on sqlservr.exe spawning cmd.exe/whoami.exe

Test 2 PowerShell download cradle via SQL Server
windows

Use xp_cmdshell to launch PowerShell that reaches out to a benign local URL, simulating a post-exploitation download cradle.

Command

powershell 
sqlcmd -S localhost -Q "EXEC xp_cmdshell 'powershell -NoProfile -Command \"Invoke-WebRequest -Uri http://127.0.0.1/test -UseBasicParsing\"';"

Cleanup

powershell 
echo No cleanup required; no file written

Expected Telemetry

sqlservr.exe -> powershell.exe with Invoke-WebRequest in the command line

Expected Detection

Rules match powershell.exe as a child of sqlservr.exe

Test 3 OLE Automation command execution
windows

Enable OLE Automation Procedures and use sp_OACreate to spawn a shell command, an alternative RCE path from within SQL Server.

Command

powershell 
sqlcmd -S localhost -Q "EXEC sp_configure 'Ole Automation Procedures',1; RECONFIGURE; DECLARE @o INT; EXEC sp_OACreate 'WScript.Shell', @o OUT; EXEC sp_OAMethod @o,'Run',NULL,'cmd /c whoami > %TEMP%\\atomic_ole.txt';"

Cleanup

powershell 
del %TEMP%\atomic_ole.txt & sqlcmd -S localhost -Q "EXEC sp_configure 'Ole Automation Procedures',0; RECONFIGURE;"

Expected Telemetry

sqlservr.exe -> cmd.exe launched via WScript.Shell OLE object

Expected Detection

Rules match cmd.exe as a child of sqlservr.exe

Related Detections

Tactic Hubs

TA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.003Windows Command ShellT1505.001SQL Stored Procedures

Same Tactic: Execution

Popular Detections