Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In most cases, the web server was attacked during the Initial Intrusion phase... in the final stage, the MS-SQL server was attacked to install CLR SqlShell.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
This function executes commands passed to it as parameters via cmd.exe.
The attacker enabled xp_cmdshell parameters to allow SQL Server to spawn a Windows command shell and pass in a string for execution... used sp_oacreate to create the OLE object wscript.shell... to execute arbitrary commands on the underlying operating system.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A shell implanted on MS-SQL servers that supports command execution, payload download, privilege escalation via BadPotato and EfsPotato, memory dumping, account creation, and shellcode execution.
SqlShell is a CLR assembly-based MS-SQL malware/backdoor that exposes command execution through a stored procedure, allowing attackers to run OS commands from SQL Server.
A DLL-based server-side malware used on MS-SQL via CLR Stored Procedure to execute attacker commands and facilitate follow-on malicious activity, including installation of coin miners or ransomware.
A .NET CLR Stored Procedure (DLL) implanted into Microsoft SQL Server to provide post-compromise capabilities (command execution, file upload/download, data theft, tunneling, account manipulation, and sometimes privilege escalation). Commonly used as an execution and staging mechanism to deploy additional payloads such as coin miners, proxyware, and ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.