Huntress Traces SQL Server Intrusion Through Defender Alerts and Forensic Evidence
Summary
Huntress describes tracing an intrusion to brute-forcing of an internet-facing SQL server, then using Defender alerts, EDR data and server logs to investigate a malicious script that added antivirus exclusions.
Key points
- Huntress says an attacker brute-forced an internet-facing SQL service on port 1433, downloaded a malicious batch script and began network enumeration.
- Microsoft Defender alerted on Meterpreter, prompting investigators to examine process data with Huntress’s Process Insights EDR.
- The batch script added Microsoft Defender exclusions for paths, extensions and process names, which Huntress interpreted as an effort to evade detection.
- SQL server logs showed repeated failed authentication attempts from foreign IP addresses, supporting the conclusion that the exposed service was the initial access vector.
- Huntress isolated the system and provided remediation actions to its partner before the incident escalated further.
- The article recommends monitoring authentication attempts and endpoint behavior, limiting Defender exclusions, and using a Sigma rule to detect the observed activity.
Article Details
- Attack Vectors
- A remote IPv4 address brute-forced an internet-facing SQL service on port 1433; server logs showed repeated failed authentication attempts before access was gained.
- The threat actor downloaded a malicious batch script to the system. Its commands added Microsoft Defender exclusions for file paths, extensions, and process names.
- After gaining access, the threat actor began enumerating the network.
- Defensive Notes
- Monitor authentication attempts and activity on public-facing servers, and retain server logs for investigation.
- Review internet-exposed services and strengthen authentication methods to reduce exposure to brute-force attempts.
- Monitor Microsoft Defender exclusion paths and limit exclusions to make it harder to evade detection.
- Collect and analyze telemetry from servers and endpoints; correlate endpoint alerts with process data, network exposure information, and forensic artifacts.
MITRE ATT&CK
T1059.003 · Windows Command ShellThe malicious batch script contained commands used to add Microsoft Defender exclusions.T1105 · Ingress Tool TransferThe threat actor downloaded a malicious batch script to the compromised system.T1110.001 · Password GuessingThe threat actor brute-forced authentication on an internet-facing SQL service; logs showed repeated failed logins.T1562.001 · Disable or Modify ToolsCommands in the batch script added Microsoft Defender exclusions for file paths, extensions, and process names.
People
Vendors
HuntressAt Huntress, we see a great deal of intrusions and share attack data with the community as we can. Today, we’ll highlight how Microsoft Defender and multiple services (namely Managed Microsoft Defender, Process InsightsMicrosoftgreat deal of intrusions and share attack data with the community as we can. Today, we’ll highlight how Microsoft Defender and multiple services (namely Managed Microsoft Defender, Process Insights and Open Port
Products
External ReconThe team next discovered that port 1433 was open for public scanning via External Recon, our platform feature that offers visibility into internet-exposed services and devices that are present in an organization.Managed AntivirusIn our webinar How to Crush Cybercriminals with Managed Antivirus, we explored the technical highlights of an intrusion via a public-facing SQL server. Now we’d like to dive in and discuss some additional pieces of theMicrosoft Defender Antimalware Platformdeal of intrusions and share attack data with the community as we can. Today, we’ll highlight how Microsoft Defender and multiple services (namely Managed Microsoft Defender, Process Insights and Open Port Detection)Open Port DetectionMicrosoft Defender and multiple services (namely Managed Microsoft Defender, Process Insights and Open Port Detection) enabled the Huntress team to identify threats in near real-time.Process Insightswe’ll highlight how Microsoft Defender and multiple services (namely Managed Microsoft Defender, Process Insights and Open Port Detection) enabled the Huntress team to identify threats in near real-time.