As cited
Copy frozen at (site build).
threat intel
Managing Attack Surface | Huntress
Huntress identified a threat actor attempting to establish persistence on an endpoint by using SQL Server (MSSQL) commands to upload a reverse shell to a web-accessible location. The attack was prevented by the organization's antivirus (MAV) and process-based detection mechanisms. This incident illustrates how attackers chain legitimate database tools with web infrastructure to gain initial access.
Why it matters: Operations and security teams should monitor for suspicious MSSQL activity and enforce strict controls on what database services can execute and where files can be written, as attackers commonly abuse trusted database tools as a stepping stone to compromise web servers.
- Source published
- First seen by Cybersecurity Tracker