Maintaining Persistence via SQL Server – Part 2: Triggers

Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.

Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.

Shares an infographic mapping common red team phishing attack workflows to blue team detective and preventative controls, plus practical stealth tips for both offensive operators and defenders.

Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.