SQL Persistent Exfiltration Trigger via External Model

Ethan Andrews@eandrews

•updated Jun 11, 2026•2•0•10

Detects the creation, alteration, or deletion of a SQL external model that could be used to establish a persistent exfiltration channel. Threat actors can leverage this to send data to an external server whenever a table is updated, particularly when combined with SQL triggers.