MSSQL 악성SQL추출하기

악성 SQL 추출하기 

1. 기준 페이지수 10,000번이상 읽는 쿼리 

2. 실행횟수 * 페이지수 = 총 읽은 페이지수를 기준으로 Descending하게 정렬하여 추출

 

--악성 sql추출
SELECT TOP 100 SUBSTRING(qt.text, (qs.statement_start_offset/2)+1,
        ((CASE qs.statement_end_offset
          WHEN -1 THEN DATALENGTH(qt.text)
         ELSE qs.statement_end_offset
         END - qs.statement_start_offset)/2)+1) SQL_TEXT,
qs.execution_count,
qs.total_logical_reads, qs.last_logical_reads,
qs.min_logical_reads, qs.max_logical_reads,
qs.total_elapsed_time, qs.last_elapsed_time,
qs.min_elapsed_time, qs.max_elapsed_time,
qs.last_execution_time
qp.query_plan
FROM sys.dm_exec_query_stats qs
CROSS APPLY sys.dm_exec_sql_text(qs.sql_handle) qt
CROSS APPLY sys.dm_exec_query_plan(qs.plan_handle) qp
WHERE qt.encrypted=0
  AND qs.max_logical_reads > 10000  
  AND qs.max_logical_reads > 10000  
ORDER BY qs.total_logical_reads DESC
;