Deep Dive: Squashing an MSSQL Attack

This report analyzes a Windows-based breach where attackers brute-forced MSSQL 'sa' credentials, used xp_cmdshell to execute shell commands, disabled antivirus using Image File Execution Options and taskkill, downloaded multiple malware samples via scripted FTP sessions, and created persistent backdoors (registry Run keys and a malicious service). The write-up includes technical details of the intrusion chain, example commands and registry changes, and IOCs including a SHA256 hash and a command-and-control IP.