MSSQL Cheat Sheet

sqlservr.exe → cmd.exe → powershell.exe

# Find suspicious child processes of sqlservr.exe
Get-WmiObject Win32_Process | Where-Object {$_.ParentProcessId -eq (Get-Process sqlservr).Id}

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL
HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL{XX}.{INSTANCENAME}\MSSQLServer\

C:\Program Files\Microsoft SQL Server\MSSQL{XX}.{INSTANCENAME}\MSSQL\Log\ERRORLOG
C:\Program Files\Microsoft SQL Server\MSSQL{XX}.{INSTANCENAME}\MSSQL\Data\
C:\Program Files\Microsoft SQL Server\MSSQL{XX}.{INSTANCENAME}\MSSQL\Backup\

sqlservr.exe      # Main SQL Server engine
sqlagent.exe      # SQL Server Agent (job execution)
sqlbrowser.exe    # Instance enumeration service
launchpad.exe     # R/Python external script execution

# Process: sqlservr.exe
# Command line includes: -s {INSTANCENAME}

Get-WmiObject Win32_Process -Filter "name='sqlservr.exe'" | Select-Object CommandLine

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQLServer\

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQLServer\Parameters

-d    # Master database file location (check for unusual paths)
-e    # Error log location (redirected logs)
-l    # Master log file location
-T    # Trace flags (persistence mechanism)

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQLServer\SuperSocketNetLib\Tcp

TcpPort    # Port number (default: 1433)
Enabled    # Whether TCP/IP is enabled
ListenOnAllIPs    # 0 = specific IPs, 1 = all IPs

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQLServer -> LoginMode

C:\Program Files\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQL\Log\ERRORLOG

C:\Program Files\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQL\Log\

ERRORLOG        # Current error log
ERRORLOG.1      # Most recent archived log
ERRORLOG.2      # Second most recent
...
ERRORLOG.6      # Oldest archived log

Failed login attempts              # Multiple rapid attempts = brute force
New logins created                 # Unauthorized account creation
Configuration changes              # sp_configure calls
xp_cmdshell enable/disable events  # Command execution capability
Database attach/detach operations  # Suspicious database operations
Backup/restore operations          # Unusual locations or timing
Startup parameters changes         # Persistence mechanisms
Service restarts                   # Potential crash or forced restart

C:\Program Files\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQL\Log\SQLAGENT.OUT

C:\Program Files\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQL\Log\*.sqlaudit

# Windows Application Event Log
Event ID: 33205    # SQL Audit events (Application log)

# Windows Security Event Log (requires special configuration)
Event ID: 33205    # SQL Audit events (Security log - tamper-proof)
Event ID: 24000    # SQL audit event
Event ID: 24001    # Login succeeded
Event ID: 24298    # Database login succeeded (action_id DBAS)

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\MSSQLServer\ExtendedProcedures

Configuration option 'show advanced options' changed from 0 to 1
Configuration option 'xp_cmdshell' changed from 0 to 1

-- Enable xp_cmdshell
EXEC sp_configure 'show advanced options', 1; RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE;

-- Execute commands
EXEC xp_cmdshell 'whoami';
EXEC xp_cmdshell 'powershell -enc <base64>';

-- Disable xp_cmdshell (cover tracks)
EXEC sp_configure 'xp_cmdshell', 0; RECONFIGURE;

Login failed for user 'sa'. Reason: Password did not match
Login failed for user 'admin'. Reason: Could not find login
Login succeeded for user 'NT AUTHORITY\SYSTEM'

4625    # Failed logon (filter by process: sqlservr.exe)
4624    # Successful logon (filter by process: sqlservr.exe)

sp_configure 'show advanced options'    # Often precedes malicious config
sp_configure 'Ole Automation Procedures' # Can be used for code execution
sp_configure 'Agent XPs'                # SQL Agent extended procedures
sp_configure 'clr enabled'              # CLR assemblies for code execution

# Find SQL Server process and connections
Get-NetTCPConnection | Where-Object {$_.LocalPort -eq 1433} | Format-Table

# Check actual configured port
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\*\MSSQLServer\SuperSocketNetLib\Tcp" -Name TcpPort

HKLM\SYSTEM\CurrentControlSet\Services\{ServiceName}\DependOnService

C:\Windows\System32\inetsrv\config\applicationHost.config

C:\Program Files\{ApplicationName}\*.config
C:\inetpub\wwwroot\{WebApp}\web.config

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQLXX.{INSTANCENAME}\Providers\

C:\Program Files\Microsoft SQL Server\MSSQL15.{INSTANCENAME}\
  ├─ MSSQL\
  │   ├─ Bin\           (executables: sqlservr.exe, sqlcmd.exe)
  │   ├─ Data\           (database files: .mdf, .ldf, .ndf)
  │   ├─ Log\            (ERRORLOG, SQLAGENT logs)
  │   ├─ Backup\         (default backup location)
  │   ├─ Jobs\           (SQL Agent job scripts - rare)
  │   └─ Bin\Resources\ (system resources)

HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL15.{INSTANCENAME}\MSSQLServer\Parameters

# Find all SQL Server instances
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL'

# Get SQL Server process details
Get-WmiObject Win32_Process -Filter "name='sqlservr.exe'" | Select-Object ProcessId,CommandLine

# Check SQL Server services
Get-Service | Where-Object {$_.DisplayName -like "*SQL*"}

# Get authentication mode
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL*\MSSQLServer' -Name LoginMode

# Get network configuration
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL*\MSSQLServer\SuperSocketNetLib\Tcp'

# Get startup parameters
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server\MSSQL*\MSSQLServer\Parameters'

# Search ERRORLOG for xp_cmdshell
grep -i "xp_cmdshell" ERRORLOG*

# Search for failed logins
grep -i "login failed" ERRORLOG* | sort | uniq -c

# Search for configuration changes
grep -i "sp_configure" ERRORLOG*

# Find potential command execution
grep -iE "xp_cmdshell|sp_configure|Ole Automation" ERRORLOG*

-- Check for xp_cmdshell enabled
EXEC sp_configure 'xp_cmdshell';

-- List all logins and their roles
SELECT name, type_desc, create_date, modify_date FROM sys.server_principals;

-- Check for suspicious databases
SELECT name, create_date, compatibility_level FROM sys.databases
ORDER BY create_date DESC;

-- List SQL Agent jobs
SELECT job_id, name, enabled, date_created, date_modified
FROM msdb.dbo.sysjobs;

-- Check linked servers
SELECT name, data_source, provider FROM sys.servers WHERE is_linked = 1;

-- Review recent backups (unusual locations)
SELECT database_name, backup_start_date, backup_finish_date,
       physical_device_name, user_name
FROM msdb.dbo.backupset
ORDER BY backup_start_date DESC;

-- Find databases with suspicious names
SELECT name FROM sys.databases
WHERE name LIKE '%[;'']%' OR name LIKE '%---%' OR name LIKE '%xp_%';

-- Check for CLR assemblies (code execution)
SELECT name, permission_set_desc, create_date FROM sys.assemblies;