Impacket MSSQLClient Execution

Georgios Maragos@Gmarak

•updated Apr 15, 2026•9•0•568

Detects execution of Impacket's MSSQL client tool, commonly used for lateral movement against Microsoft SQL servers using compromised credentials. Includes detection of proxychains usage and Python-based execution patterns.