SQL Persistent Exfiltration Trigger

Ethan Andrews@eandrews

•updated Jun 11, 2026•3•0•19

Detects the creation or alteration of a SQL trigger that utilizes sp_invoke_external_rest_endpoint. Attackers can abuse database triggers to automatically exfiltrate newly added credentials or sensitive records in real-time.