Huntress Details MSSQL Intrusion Involving Database File Extraction
Summary
Huntress analysts found files extracted from an MSSQL database, including scripts intended to create accounts and launch remote-access and tunneling tools. They found no evidence the files ran before the customer was notified and the issue addressed.
Key points
- Huntress described brute-force attempts against publicly accessible MSSQL servers and noted that successful logins may be indicated by changes to xp_cmdshell or unusual child processes of sqlservr.exe.
- In the investigated incident, an MSSQL native bulk copy command extracted several files from a database.
- The extracted scripts were designed to create an administrator account, enable WDigest credential storage, and launch AnyDesk and a tunneling tool.
- Analysts found no evidence the extracted scripts had run; Huntress said it notified the customer and took action to address and remediate the issue.
- Huntress reported other incidents involving MSSQL servers and IPs in the 2.57.149.x range, including failed logins and a command mapping a share from an endpoint in that range.
- Huntress recommends maintaining an accurate asset inventory, limiting public exposure of services through network controls, and monitoring endpoints.
Article Details
- Attack Vectors
- Internet-exposed MSSQL servers received brute-force login attempts; the article reports successful access indicators in related incidents.
- In the January incident, files were extracted from an MSSQL database using the native bulk copy command, bcp.
- A batch file found among the extracted files was intended to launch a tunneling tool and AnyDesk; the article says there was no evidence these files were executed.
- In a separate December incident, a command mapped a network share on an endpoint the article identifies as attacker-controlled.
- Defensive Notes
- Maintain an accurate inventory of systems, applications, and services, and reduce exposure of services to the public Internet.
- Configure firewalls, routers, and network architecture to permit only authorized traffic to exposed endpoints.
- Monitor endpoints for successful MSSQL logins, changes to xp_cmdshell, unusual child processes of sqlservr.exe, and bcp.exe activity.
- Apply comprehensive endpoint monitoring, detection, and response.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 2[.]57[.]149[.]230 | IP address of an endpoint the article identifies as attacker-controlled; a December incident used it as the destination of a mapped network share. |
| IPV4 | 2[.]57[.]149[.]233 | IP address specified as the endpoint for a tunneling tool in a batch file found among files extracted during the January incident; the file was not observed executing. |
MITRE ATT&CK
T1005 · Data from Local SystemIn the January incident, bcp was used to extract files from an MSSQL database to the endpoint.T1021.002 · SMB/Windows Admin SharesIn the December incident, a net use command mapped a share on the endpoint at 2.57.149[.]230, which the article identifies as attacker-controlled.T1110.001 · Password GuessingThe article reports brute-force login attempts against publicly accessible MSSQL servers.T1112 · Modify RegistryAn extracted batch script contained a registry command setting WDigest UseLogonCredential to 1; the article says there was no evidence the script was executed.T1136.001 · Local AccountExtracted PowerShell and batch scripts contained commands to create local user accounts; the article says there was no evidence the scripts were executed.