Attacking MSSQL Servers, Pt. II | Huntress Blog

Huntress investigated automated MSSQL attacks in which threat actors used xp_cmdshell and bcp.exe to extract binaries from a database table into C:\users\public\music, executed batch files that created a persistent admin account and installed AnyDesk, and were stopped prior to a ransomware deployment; the report provides telemetry, IOCs, MITRE ATT&CK mappings, and recommendations for asset inventory and attack-surface reduction.