STIGQter: STIG Summary: Microsoft SQL Server 2022 Instance Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SQL Server must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to SQL Server.

DISA Rule

SV-271284r1109111_rule

Vulnerability Number

V-271284

Group Title

SRG-APP-000133-DB-000179

Rule Version

SQLI-22-006600

Severity

CAT II

CCI(s)

• CCI-001499 - Limit privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Implement and document a process by which changes made to software libraries are monitored and alerted. A PowerShell based hashing solution is one such process. The Get-FileHash command can be used to compute the SHA-2 hash of one or more files. For more information, refer to the following link:
https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/get-filehash

Using the Export-Clixml command, a baseline can be established and exported to a file:
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/export-clixml?view=powershell-7.5

Using the Compare-Object command, a comparison of the latest baseline versus the original baseline can expose the differences:
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-powershell-1.0/ee156812(v=technet.10)?redirectedfrom=MSDN

Check Contents

Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum.

If alerts do not at least hash their value, this is a finding.

To determine the location for these instance-specific binaries:

1. Launch SQL Server Management Studio (SSMS).
2. Connect to the instance to be reviewed.
3. Right-click server name in Object Explorer.
4. Click "Facets".
5. Select the "Server" facet.
6. Record the value for the "RootDirectory" facet property.

Tip: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.

Vulnerability Number

V-271284

Documentable

False

Rule Version

SQLI-22-006600

Severity Override Guidance

Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum.

If alerts do not at least hash their value, this is a finding.

To determine the location for these instance-specific binaries:

1. Launch SQL Server Management Studio (SSMS).
2. Connect to the instance to be reviewed.
3. Right-click server name in Object Explorer.
4. Click "Facets".
5. Select the "Server" facet.
6. Record the value for the "RootDirectory" facet property.

Tip: Use the Get-FileHash cmdlet shipped with PowerShell 5.0 to get the SHA-2 hash of one or more files.

Check Content Reference

M

Target Key

5677