Detect CVE-2019-1068: Microsoft SQL Server Remote Code Execution in Splunk
Detects exploitation attempts and indicators of CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server. The flaw allows an attacker who can submit specially crafted queries to trigger memory corruption in the SQL Server database engine, potentially leading to arbitrary code execution in the context of the SQL Server service account. This detection focuses on anomalous SQL Server process behavior (child processes spawned from sqlservr.exe), suspicious xp_cmdshell / OLE automation usage, malformed query patterns, and failed/unpatched-instance indicators. CVE-2019-1068 is listed on the CISA Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Execution Lateral Movement
SPL Detection Query
index=* (sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
(EventCode=4688 OR EventCode=1)
parent_process="*sqlservr.exe"
(New_Process_Name="*\\cmd.exe" OR New_Process_Name="*\\powershell.exe" OR New_Process_Name="*\\wscript.exe" OR New_Process_Name="*\\cscript.exe" OR New_Process_Name="*\\certutil.exe" OR New_Process_Name="*\\bitsadmin.exe" OR New_Process_Name="*\\rundll32.exe" OR New_Process_Name="*\\mshta.exe")
| stats count min(_time) as firstTime max(_time) as lastTime values(New_Process_Name) as child_procs values(Process_Command_Line) as cmdlines by host, parent_process, Account_Name
| convert ctime(firstTime) ctime(lastTime)Correlates Windows/Sysmon process-creation events where sqlservr.exe spawns a shell or LOLBin, indicating possible exploitation of a SQL Server RCE such as CVE-2019-1068.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Scheduled DBA jobs invoking OS commands through xp_cmdshell
- SQL Agent ETL/backup jobs that shell out legitimately
- Vendor database tooling that spawns helper processes
Other platforms for CVE-2019-1068
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1xp_cmdshell process spawn from SQL Server
Expected signal: Process creation event: sqlservr.exe -> cmd.exe -> whoami.exe with the SQL service account
- Test 2PowerShell download cradle via SQL Server
Expected signal: sqlservr.exe -> powershell.exe with Invoke-WebRequest in the command line
- Test 3OLE Automation command execution
Expected signal: sqlservr.exe -> cmd.exe launched via WScript.Shell OLE object
References (4)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068
- https://nvd.nist.gov/vuln/detail/CVE-2019-1068
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Response Playbook
Triage
- Confirm the SQL Server instance version and patch level on the affected host; verify whether the July 2019 update addressing CVE-2019-1068 (KB4505217/KB4505219/KB4505222 depending on version) is installed.
- Review the full command line of the child process spawned by sqlservr.exe and determine whether it maps to a known SQL Agent job, maintenance plan, or authorized xp_cmdshell use.
- Correlate the SQL Server service account activity around the alert time with authentication logs and SQL error logs for malformed query batches or unexpected logins.
- Check whether xp_cmdshell, OLE Automation Procedures, or CLR integration are enabled on the instance via sp_configure.
Containment
- Isolate the affected SQL Server host from the network if unauthorized code execution is confirmed.
- Disable xp_cmdshell and OLE Automation Procedures on the instance and rotate the SQL Server service account and any SQL logins with elevated privileges.
- Block the offending source IP(s) at the firewall and restrict TDS (port 1433/named instances) access to trusted application subnets.
Evidence Collection
- Collect SQL Server ERRORLOG files, the default trace, and any XEvent/Extended Events sessions covering the alert window.
- Capture the process tree, command lines, and loaded modules for sqlservr.exe and its child processes from EDR telemetry.
- Preserve Windows Security/Sysmon event logs, and image memory of the SQL Server host if RCE is confirmed.
Escalation Criteria
- !Escalate to incident response if sqlservr.exe spawned an interactive shell or downloaded/executed a payload.
- !Escalate to the vulnerability management owner if the instance is confirmed unpatched for CVE-2019-1068 and internet-reachable.
- !Escalate to the data-protection team if evidence indicates database exfiltration or credential theft from the SQL host.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
SQL Server ERRORLOG entries showing crashes, stack dumps (.mdmp) or malformed batch execution - >
sqlservr.exe child-process records in EDR/Sysmon (EventID 1) and Security 4688 logs - >
sp_configure state for xp_cmdshell and OLE Automation, and SQL Agent job history
Tuning Guidance
Build an allowlist of known-good child processes and command lines produced by legitimate SQL Agent jobs and maintenance plans, then exclude those specific parent-child-cmdline combinations. Where xp_cmdshell is required operationally, scope exclusions to the specific job step accounts and hosts rather than disabling the rule. Prioritize alerts from internet-reachable or unpatched instances.
Hunting Queries
Baselines and surfaces all distinct child processes of sqlservr.exe per host to spot anomalous execution following possible CVE-2019-1068 exploitation.
DeviceProcessEvents | where InitiatingProcessFileName =~ "sqlservr.exe" | summarize count() by FileName, DeviceName, InitiatingProcessAccountName | order by count_ descindex=* (EventCode=4688 OR EventCode=1) parent_process="*sqlservr.exe" | stats count values(New_Process_Name) as children by host, Account_NameAtomic Red Team Tests
Enable and invoke xp_cmdshell to simulate OS command execution from the SQL Server engine, producing a cmd.exe child of sqlservr.exe.
Command
sqlcmd -S localhost -Q "EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; EXEC xp_cmdshell 'whoami';"Cleanup
sqlcmd -S localhost -Q "EXEC sp_configure 'xp_cmdshell',0; RECONFIGURE; EXEC sp_configure 'show advanced options',0; RECONFIGURE;"Expected Telemetry
Process creation event: sqlservr.exe -> cmd.exe -> whoami.exe with the SQL service account
Expected Detection
KQL/SPL rules fire on sqlservr.exe spawning cmd.exe/whoami.exe
Use xp_cmdshell to launch PowerShell that reaches out to a benign local URL, simulating a post-exploitation download cradle.
Command
sqlcmd -S localhost -Q "EXEC xp_cmdshell 'powershell -NoProfile -Command \"Invoke-WebRequest -Uri http://127.0.0.1/test -UseBasicParsing\"';"Cleanup
echo No cleanup required; no file writtenExpected Telemetry
sqlservr.exe -> powershell.exe with Invoke-WebRequest in the command line
Expected Detection
Rules match powershell.exe as a child of sqlservr.exe
Enable OLE Automation Procedures and use sp_OACreate to spawn a shell command, an alternative RCE path from within SQL Server.
Command
sqlcmd -S localhost -Q "EXEC sp_configure 'Ole Automation Procedures',1; RECONFIGURE; DECLARE @o INT; EXEC sp_OACreate 'WScript.Shell', @o OUT; EXEC sp_OAMethod @o,'Run',NULL,'cmd /c whoami > %TEMP%\\atomic_ole.txt';"Cleanup
del %TEMP%\atomic_ole.txt & sqlcmd -S localhost -Q "EXEC sp_configure 'Ole Automation Procedures',0; RECONFIGURE;"Expected Telemetry
sqlservr.exe -> cmd.exe launched via WScript.Shell OLE object
Expected Detection
Rules match cmd.exe as a child of sqlservr.exe