2016 Ukraine Electric Power AttackC0025 ↗
During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.1
tfMITRE ATT&CK sub-technique
SQL Stored Procedures T1505.001
sub-technique of T1505 Server Software Component
- Tactic
- Persistence
- Platforms
- Windows, Linux
- Version
- 1.1
- Created
- 12 December 2019
- Last modified
- 24 October 2025
- Contributors
- Carlos Borges, @huntingneo, CIP; Lucas da Silva Pereira, @vulcanunsec, CIP; Kaspersky
Adversaries may abuse SQL stored procedures to establish persistent access to systems. SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries. Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events (e.g. when a SQL server application is started/restarted).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.8
Detection rules71st pct
Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.SQL Stored Procedures MITRE reference T1505.001
72nd pctamong all ATT&CK techniques for number of campaigns
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
Offense vs defense T1505.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 6
first rule: 2022 Q4 · 0 of 1 campaigns plotted (2016 Ukraine Electric Power Attack (dated 2016) falls before the 2019 window)SQL Stored Procedures detection strategy DET0181
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for SQL Stored Procedures Abuse via T1505.001
2 platforms
AN0511 · Windows
Creation or modification of stored procedures invoking xp_cmdshell or CLR assemblies for command execution and persistence.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Application | CLR Assembly creation, loading, or modification logs via MSSQL CLR integration |
| Script ExecutionDC0029 | WinEventLog:Application | Stored procedure creation, modification, or xp_cmdshell invocation via SQL logs or SQL Server auditing |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| xp_cmdshell_invocation_threshold | Adjust if legitimate procedures use xp_cmdshell often in environment |
| CLRAssemblyNameWhitelist | Organization-defined whitelist of legitimate CLR assemblies |
| TimeWindow | Tune time window to correlate stored procedure creation with process execution |
AN0512 · Linux
SQL stored procedures that invoke OS-level commands via xp_cmdshell equivalent or via UDF (User-Defined Functions) mechanisms.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Script ExecutionDC0029 | ApplicationLogs:SQL | Stored procedure creation or modification with shell invocation (e.g., system(), exec()) |
| Process CreationDC0032 | auditd:SYSCALL | execve |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandRegex | Regex used to detect suspicious OS commands via SQL |
| TimeWindow | Window for correlating procedure creation and command execution |
AuditM1047
Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.
Code SigningM1045
Ensure all application component binaries are signed by the correct application developers.
Do not allow administrator accounts that have permissions to add component software on these services to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.