PUB-2026-0308-0001

MSSQLEvents8BehaviorYesPrimitives5Duration1s

mssql_server_capability_enumeration_sequencemedium

MSSQL session sequence performing automated server reconnaissance through multiple sp_server_info calls, case-sensitivity probing, charset and configuration enumeration from master.dbo tables, and session environment adjustments (set textsize, set arithabort on). The observed queries indicate scripted capability discovery and environment profiling based strictly on database command activity.

Session Events8 events · 1s

003:39:47authsa·login7

103:39:48sqlexec sp_server_info 1

▸ 1 field

203:39:48sqlexec sp_server_info 2

▸ 1 field

303:39:48sqlexec sp_server_info 500

▸ 1 field

403:39:48sqlselect 501,NULL,1 where 'a'='A'

▸ 1 field

503:39:48sql

select 504,c.name,c.description,c.definition 
from master.dbo.syscharsets c,master.dbo.syscharsets c1,master.dbo.sysconfigures f 
where f.config=123 
and f.value=c1.id 
and c1.csid=c.id

▸ 1 field

603:39:48sqlset textsize 2147483647

▸ 1 field

703:39:48sqlset arithabort on

▸ 1 field

Matched Primitives