• Can you give an example of code not looking genuine? SELECT queries and execution of stored procedures would be hard to manipulate in this way as they don't fire DML triggers. You might be able to do something with extended events or via the results of traces, but if you use a trace, there's always going to be a lag.

    K. Brian Kelley
    @kbriankelley