Detect SQL Stored Procedures in Microsoft Sentinel

// T1505.001 — SQL Stored Procedure persistence detection
// Focus on process execution from SQL Server processes
// Part 1: Detect OS commands spawned by SQL Server (xp_cmdshell execution)
let SQLShellExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("sqlservr.exe", "sqlagent.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "certutil.exe", "bitsadmin.exe", "rundll32.exe",
                      "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe")
| extend DetectionType = "SQL_Server_OS_Command"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Part 2: Detect SQL Server process writing files to disk (CLR assembly drop or payload)
let SQLFileWrite = DeviceFileEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("sqlservr.exe", "sqlagent.exe")
| where ActionType == "FileCreated"
| where FolderPath !has "\\Microsoft SQL Server\\"
| where FolderPath !has "\\MSSQL\\"
| extend DetectionType = "SQL_Server_File_Write"
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
          InitiatingProcessFileName, DetectionType;
// Part 3: Detect registry changes related to SQL Server CLR/startup configuration
let SQLRegistryMod = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any ("SQL Server", "MSSQLSERVER", "SQLServer")
| where RegistryValueName has_any ("xp_cmdshell", "clr enabled", "startup", "CLR")
| extend DetectionType = "SQL_Server_Config_Change"
| project Timestamp, DeviceName, AccountName, RegistryKey, RegistryValueName, RegistryValueData,
          InitiatingProcessFileName, DetectionType;
union SQLShellExec, SQLFileWrite, SQLRegistryMod
| sort by Timestamp desc