mdecrevoisier high experimental sigma

SQL server sqlcmd utility abuse for privilege escalation

Detects scenarios where an attacker uses sqlcmd utility to escalate privileges or introduce weaknesses.

View Source

Detection Logic

{
  "selection": {
    "NewProcessName
| endswith": [
      "\\sqlcmd.exe",
      "\\osql.exe"
    ],
    "CommandLine
| contains": [
      "/Q",
      "-Q"
    ]
  },
  "condition": "selection"
}

False Positives

  • ⚠ Master database restore procedure
  • ⚠ Maintenance operation
  • ⚠ Legitim SA account password recovery

Field Validations

Loading…

Comments (0)

Loading comments...