xp_cmdshell is a SQL Server extended stored procedure that executes operating-system commands from a SQL Server instance. It is disabled by default because it can move an attacker from SQL Server into the host operating system, running under the SQL Server service account. section 14.4
Mistake #97: treating it as a harmless DBA convenience. The common belief that only sysadmin members can use it, or that disabling it is pointless because an administrator can re-enable it, does not remove the risk. Enabling it creates another route from a compromised instance toward the operating system and potentially other servers. section 14.4
Lateral movement
Trace the attack path: compromise of a SQL Server instance can lead through xp_cmdshell to operating-system access, then to credential exposure or other servers. section 14.4
Configuration drift: the newly built instance
A SQL Server instance can meet a CIS Level 1 baseline at build time, then become vulnerable when a junior DBA enables xp_cmdshell days later. Limiting permissions and auditing help, but periodic configuration management can detect the drift and automatically restore the intended state. section 8.9
Use a defensive operating rule:
- Keep xp_cmdshell disabled; regard its activation as a security vulnerability rather than a routine configuration choice. section 8.9 section 14.8
- Configure a P1 alert for any attempt to enable it, providing early warning before an attack succeeds. section 14.8
- Audit privileged administrative activity and apply least privilege, including temporary elevation followed by revocation when exceptional work is complete. section 14.0 section 14.8
- Use configuration management to periodically evaluate the instance and automatically correct a drifted setting; Puppet, Ansible, and PowerShell DSC are cited options. section 8.9
A server-level trigger can inspect ALTER_INSTANCE activity for commands containing both sp_configure and xp_cmdshell, raise an error, log the attempt, and roll it back. Treat such a control as one layer, alongside alerts, auditing, permissions, and configuration management. section 14.4 section 14.8
