srl
MSSQL
Microsoft SQL Server (MSSQL) is Microsoft’s SQL-based relational database management system. The default port is TCP 1433. In Active Directory environments, MSSQL is consistently one of the highest-value targets: it is almost always over-privileged, frequently under-monitored, and the service account running it is typically a domain account with broad rights.
2025–2026 context: the attack surface has expanded in three directions. SQL Server 2025’s AI features (sp_invoke_external_rest_endpoint, CREATE EXTERNAL MODEL) provide native HTTPS exfiltration and C2 channels that never touch xp_cmdshell. Microsoft-signed stored procedures contain SQL injection that re-enables a disabled xp_cmdshell. And Machine Learning Services (sp_execute_external_script) is now a documented xp_cmdshell alternative because EDR has become very good at catching the classic path.