Full Report
In addition to social engineering attacks, threat actors target organizations' attack surface, looking for exposed services and applications to gain access into an infrastructure. Microsoft SQL database servers have long been a target for attackers.
Analysis Summary
# Tool/Technique: MSSQL Exploitation via BCP and xp_cmdshell
## Overview
Threat actors target Internet-exposed Microsoft SQL (MSSQL) servers, often utilizing default configurations or weak credentials to gain initial access. Once inside, they leverage native SQL functionalities—specifically the `bcp` (Bulk Copy Program) utility and `xp_cmdshell`—to drop malicious payloads, establish persistence, and facilitate lateral movement.
## Technical Details
- **Type:** Technique / Attack Vector
- **Platform:** Windows (MSSQL Server)
- **Capabilities:** Database exploitation, file extraction/creation, privilege escalation, and remote access deployment.
- **First Seen:** Historically active (e.g., SQL Slammer 2003); current campaign reported February 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application
- T1110.001 - Brute Force: Password Guessing
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- **TA0003 - Persistence**
- T1136.001 - Create Account: Local Account
- **TA0005 - Defense Evasion**
- T1070.004 - Indicator Removal: File Deletion
- T1112 - Modify Registry
- **TA0010 - Exfiltration**
- T1011.001 - Exfiltration Over Alternative Service: Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **xp_cmdshell Misuse:** Enabling this stored procedure allows the attacker to execute shell commands directly via the SQL instance.
- **BCP Extraction:** Using the `bcp` utility to "query out" binary data stored in database tables into executable files (e.g., `.exe`, `.bat`, `.ps1`) on the local file system.
- **Account Creation:** Automated scripts (`net user`, `New-LocalUser`) to create administrative accounts for persistent access.
### Advanced Features
- **Tunneling:** Deployment of specialized tools to bypass firewalls and establish remote connections.
- **Credential Harvesting Preparation:** Modifying registry keys (e.g., `WDigest` `UseLogonCredential`) to force the storage of passwords in clear text in memory.
- **Automated Cleanup:** Scripted self-deletion commands (`del "%~f0"` or `Remove-Item`) to remove traces of the attack tools immediately after execution.
## Indicators of Compromise
- **File Names:**
- `user.ps1`
- `user.bat`
- `kur.bat`
- `AD.exe` (AnyDesk)
- `4.exe` (Tunneling tool)
- `FODsOZKgAU.txt` (BCP format file)
- **Registry Keys:**
- `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\wdigest\UseLogonCredential` (Set to `0x1`)
- **Network Indicators:**
- `2.57.149[.]233` (C2/Tunneling IP)
- Port `3377`
- **Behavioral Indicators:**
- `sqlservr.exe` spawning child processes like `cmd.exe` or `powershell.exe`.
- Use of `bcp.exe` with `queryout` parameters to `C:\Users\Public\`.
- Execution of `net localgroup administrators` by the SQL service account.
## Associated Threat Actors
- **Turkish-speaking threat actors** (indicated by script comments/variables like *"Yeni kullanıcı hesabı oluşturuldu"*, *"sifre"*, and *"isim"*).
- Linked to **Mimic Ransomware** campaigns.
## Detection Methods
- **Signature-based:** Monitoring for the specific Turkish-language strings in PowerShell scripts and AnyDesk installers in unusual directories.
- **Behavioral detection:**
- Alerting on `xp_cmdshell` configuration changes in SQL logs.
- Monitoring for successful logins following a high volume of failed brute-force attempts.
- Detecting SQL service accounts modifying local group memberships.
- **YARA:** Scan for `bcp` command-line strings and WDigest registry modifications.
## Mitigation Strategies
- **Attack Surface Reduction:** Do not expose MSSQL servers directly to the Internet; use VPNs or IP allowlists.
- **Hardening:** Disable `xp_cmdshell` unless strictly necessary.
- **Least Privilege:** Run the MSSQL service under a low-privileged service account rather than `LocalSystem` or a Domain Admin.
- **Authentication:** Enforce strong password policies and multi-factor authentication (MFA) where possible.
- **Logging:** Enable "Audit Successful Logins" in MSSQL properties to track unauthorized access.
## Related Tools/Techniques
- **SQL Slammer:** Historic worm targeting MSSQL.
- **AnyDesk:** Legitimate RMM tool frequently abused by actors for persistence.
- **Mimikatz:** Often used in conjunction with WDigest registry changes to dump credentials.