diff --git a/templates/tsql/Audit Command Execution Template.sql b/templates/tsql/Audit Command Execution Template.sql index 32d3582..867e0f2 100644 --- a/templates/tsql/Audit Command Execution Template.sql +++ b/templates/tsql/Audit Command Execution Template.sql @@ -21,7 +21,7 @@ WITH (STATE = ON) CREATE SERVER AUDIT SPECIFICATION [Audit_Server_Configuration_Changes] FOR SERVER AUDIT DerbyconAudit ADD (AUDIT_CHANGE_GROUP), -- Audit Audit changes -ADD (SERVER_OPERATION_GROUP) -- Audit server changes +ADD (SERVER_OPERATION_GROUP) -- Audit server changes (Enabling oscmdexec options) WITH (STATE = ON) -- DATABASE: Audit common agent job activity @@ -30,9 +30,9 @@ WITH (STATE = ON) Use msdb CREATE DATABASE AUDIT SPECIFICATION [Audit_Agent_Jobs] FOR SERVER AUDIT [DerbyconAudit] -ADD (EXECUTE ON OBJECT::[dbo].[sp_delete_job] BY [dbo]), -ADD (EXECUTE ON OBJECT::[dbo].[sp_add_job] BY [dbo]), -ADD (EXECUTE ON OBJECT::[dbo].[sp_start_job] BY [dbo]) +ADD (EXECUTE ON OBJECT::[dbo].[sp_delete_job] BY [dbo]), -- Audit agent job delete +ADD (EXECUTE ON OBJECT::[dbo].[sp_add_job] BY [dbo]), -- Audit agent job add * ssis, cmdexec, powershell, active scripting (jscript/vbscript) +ADD (EXECUTE ON OBJECT::[dbo].[sp_start_job] BY [dbo]) -- Audit agent job start WITH (STATE = ON) -- DATABASE: Audit potentially dangerous procedures @@ -41,7 +41,8 @@ WITH (STATE = ON) use master CREATE DATABASE AUDIT SPECIFICATION [Audit_OSCMDEXEC] FOR SERVER AUDIT [DerbyconAudit] -ADD (EXECUTE ON OBJECT::[dbo].[xp_cmdshell] BY [dbo]), -- Audit xp_cmdshell execution +ADD (EXECUTE ON OBJECT::[dbo].[xp_cmdshell] BY [dbo]), -- Audit xp_cmdshell execution (os commands) +ADD (EXECUTE ON OBJECT::[dbo].[xp_regwrite] BY [dbo]), -- Audit xp_regwrite execution (potential registry autoruns) ADD (EXECUTE ON OBJECT::[dbo].[sp_addextendedproc] BY [dbo]), -- Audit additional of custom extended stored procedures ADD (EXECUTE ON OBJECT::[dbo].[sp_execute_external_script] BY [dbo]), -- Audit execution of external scripts such as R and Python ADD (EXECUTE ON OBJECT::[dbo].[Sp_oacreate] BY [dbo]) -- Audit OLE Automation Procedure execution