While a valid cryptographic digital signature ensures the authenticity and integrity of a compiled binary, targeting dynamic database runtime components—such as In-Memory OLTP (XTP) directories—presents a severe attack vector if integrity controls are bypassed.
Because database services like SQL Server frequently operate under high-privilege service accounts (such as NT AUTHORITY\SYSTEM or a high-privileged virtual account), an adversary who achieves local administrative access could attempt to substitute or hijack dynamic runtime DLLs. A successful payload injection into the SQL Server process memory (sqlservr.exe) would inherit the service’s privileges, facilitating arbitrary code execution, local privilege escalation to SYSTEM, or the establishment of an outbound reverse shell.
Click through for a demonstration and Microsoft Security’s response.