Skip to content
Threat Feed

Product

SQL Server

5 briefs RSS
high advisory

Windows SQL Server xp_cmdshell Configuration Change Detected

Detection of changes to the xp_cmdshell configuration in SQL Server, a feature often abused by attackers for privilege escalation and lateral movement by enabling execution of operating system commands.

SQL Server +3 sql_server xp_cmdshell privilege_escalation lateral_movement windows
2r 1t
high advisory

SQL Server Critical Procedures Enabled Leading to Potential Code Execution or Reconnaissance

Modification of critical SQL Server configuration options, such as 'Ad Hoc Distributed Queries', 'external scripts enabled', 'Ole Automation Procedures', 'clr enabled', and 'clr strict security', can enable attackers to perform Active Directory reconnaissance and execute arbitrary code, potentially leading to code execution or reconnaissance activities.

SQL Server +3 sql-server code-execution reconnaissance windows
2r 2t
high advisory

CVE-2026-40370: SQL Server External Control of File Name or Path Vulnerability

CVE-2026-40370 allows an authorized attacker with control over file names or paths to execute code over a network in Microsoft SQL Server.

SQL Server cve sql_server rce
2r 1t 1c
medium threat

MSSQL xp_cmdshell Stored Procedure Abuse for Persistence

Attackers may leverage the xp_cmdshell stored procedure in Microsoft SQL Server to execute arbitrary commands for privilege escalation and persistence, often bypassing default security configurations.

SQL Server persistence sql-server xp_cmdshell windows
2r 2t
medium advisory

LSASS Memory Dump Creation Detection

This rule identifies the creation of LSASS memory dump files, often indicative of credential access attempts using tools like Task Manager, SQLDumper, Dumpert, or AndrewSpecial, by monitoring for specific filenames and excluding legitimate dump locations.

Elastic Defend +4 credential_access lsass memory_dump windows
2r 1t