Software Library Monitoring for SQL STIG

Intro

MS SQL Server Instance STIG requires a monitoring process for the software libraries associated with it. It seems odd that there are no apparent OOTB solutions to this problem. This STIG item also appears to be extremely redundant since so many controls are in place before a malicious actor could possibly get to this point. Not to mention that this control does not really provide fidelity on the integrity of the software libraries. Nonetheless, I am attempting to provide a potential solution for those that may Google this issue.

STIG Text

Rule Title

SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.

Discussion

Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum.

If alerts do not at least hash their value, this is a finding.

To determine the location for these instance-specific binaries:

Launch SQL Server Management Studio (SSMS) >> Connect to the instance to be reviewed >> Right-click server name in Object Explorer >> Click Facets >> Select the Server facet >> Record the value for the "RootDirectory" facet property

TIP: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.

Fix Text

Implement and document a process by which changes made to software libraries are monitored and alerted.

A PowerShell based hashing solution is one such process. The Get-FileHash command (https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash) can be used to compute the SHA-2 hash of one or more files.

Using the Export-Clixml command (https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Export-Clixml), a baseline can be established and exported to a file.

Using the Compare-Object command (https://technet.microsoft.com/en-us/library/ee156812.aspx), a comparison of the latest baseline versus the original baseline can be used to expose the differences.

Solution

The following script generates a baseline csv file and an output comparison file.

# path for folder that contains baselines and comparisons
$fileHashPath = "x:\files\" 
$baseLinePath = "$fileHashPath\baseline.csv"
$isBaselinePresent = Test-Path $baseLinePath

# rootPath as checked under facets (see check text of stig)
$rootPath = "s:\path\to\root"
$files = Get-ChildItem $rootPath -File -Recurse
$fileInformation = $files | ForEach-Object  {
    $fn = $_.FullName
    $hashObj = [pscustomobject](Get-FileHash $fn)
    $owner = Get-Acl -Path $fn | Select-Object Owner
    $modified = $_.LastWriteTime
    $hashObj | Add-Member -MemberType NoteProperty -Name "Owner" -Value $owner
    $hashObj | Add-Member -MemberType NoteProperty -Name "Modified" -Value $modified
    $hashObj
}

If($isBaselinePresent -eq $false){
    $fileInformation | Export-CSV -Path $baseLinePath -NoTypeInformation
} Else {
    $dt = (get-date -Format "yyyyMMddhhmm")
    $fileHashLogPath = "$filehashpath\files$dt.csv"
    $fileInformation | Export-CSV -Path $fileHashLogPath -NoTypeInformation
    $baseline = Import-Csv $baseLinePath
    $currentFiles = Import-Csv $fileHashLogPath
    $comparison =  Compare-Object -ReferenceObject $baseline -DifferenceObject $currentFiles -Property Path,Hash,Modified,Owner
    If($comparison.Length -gt 0){ 
        $comparison | Export-Csv -Path "$filehashpath\comparison$dt.csv" -NoTypeInformation
    }
}

This script can be ran with a scheduled task.

The only thing that remains is the monitoring which may be done with the following.

Generate an email.
Create an event and rely on an event monitoring tool.
Manually check the output.

dennythecoder/Library Monitoring for SQL STIG.md