Maintaining Persistence via SQL Server – Part 1: Startup Stored Procedures

Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.

Demonstrates using PowerUpSQL and the xp_regwrite extended stored procedure to write Windows registry Run keys from SQL Server, establishing persistence with the service account's privileges.

Demonstrates creating, importing, exporting, and altering SQL Server CLR assemblies to execute OS commands, escalate to sysadmin, and persist, with new PowerUpSQL functions for AD-wide campaigns.

Introduces Get-SQLServerLinkCrawl, which walks every accessible linked server path from an initial SQL Server foothold, exposing versions, link-user privileges, and query execution across links.

Shares an infographic mapping common red team phishing attack workflows to blue team detective and preventative controls, plus practical stealth tips for both offensive operators and defenders.

Dumps Windows auto-login credentials through SQL Server using xp_regread and PowerUpSQL, covering post-SP4 access restrictions and useful registry reads for least-privilege logins.