Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
This function executes commands passed to it as parameters via cmd.exe.
The attacker enabled xp_cmdshell parameters to allow SQL Server to spawn a Windows command shell and pass in a string for execution... used sp_oacreate to create the OLE object wscript.shell... to execute arbitrary commands on the underlying operating system.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SqlShell is a CLR assembly-based MS-SQL malware/backdoor that exposes command execution through a stored procedure, allowing attackers to run OS commands from SQL Server.
A DLL-based server-side malware used on MS-SQL via CLR Stored Procedure to execute attacker commands and facilitate follow-on malicious activity, including installation of coin miners or ransomware.
A .NET CLR Stored Procedure (DLL) implanted into Microsoft SQL Server to provide post-compromise capabilities (command execution, file upload/download, data theft, tunneling, account manipulation, and sometimes privilege escalation). Commonly used as an execution and staging mechanism to deploy additional payloads such as coin miners, proxyware, and ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.