Establishing Registry Persistence via SQL Server with PowerUpSQL

Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.

Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.

Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.

Demonstrates using PowerUpSQL to discover accessible domain SQL Servers and rapidly sample databases for sensitive PCI, HIPAA, and other regulated records at scale.