Database Service Lateral Movement

Using valid SQL Server credentials over a reachable SQL Server service, an operator can invoke enabled xp_cmdshell to run an operating-system command on the database host. This is remote service use for lateral movement; the spawned Windows process runs as the SQL Server service account for sysadmin callers, or as the configured xp_cmdshell proxy account for permitted non-sysadmin callers. This reviewed workflow demonstrates command execution and configuration restoration; it does not itself create persistence or a command-and-control shell.