AD-MSSQL-LINKLateral Movement

MSSQL Linked Server Crawl

Hop across linked SQL servers via openquery / 4-part-naming — gain code execution on each link.

§ Where this technique fits

AD-MSSQL-LINK is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

MSSQL linked-server crawl → cross-host RCE
Linked-server trust chains in MSSQL let a low-priv login execute as a higher-priv login on a remote SQL host — and pivot recursively across the estate.
step 2 / 6

§ What commonly comes next

01
MSSQL EXECUTE AS
AD-MSSQL-IMPERSONATE · Privilege Escalation
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

MSSQL linked-server crawl → cross-host RCE

§ What commonly comes next