AD-MSSQL-XPCMDExecution

MSSQL xp_cmdshell

Enable xp_cmdshell on a SQL server you have sysadmin on — run shell commands as the service account.

§ Where this technique fits

AD-MSSQL-XPCMD is catalogued under the Execution tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

§ Dossiers chaining this technique

MSSQL linked-server crawl → cross-host RCE
Linked-server trust chains in MSSQL let a low-priv login execute as a higher-priv login on a remote SQL host — and pivot recursively across the estate.
step 4 / 6

§ What commonly comes next

01
Command and Scripting Interpreter
T1059 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

MSSQL linked-server crawl → cross-host RCE

§ What commonly comes next