Sunturai
Back to results
MediumSplunk security contentMichael Haag +1Threat hunting

Windows SQLCMD Execution

This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both…

Description

This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
crowdstrike_processrollup2sysmon_eventid_1windows_event_log_security_4688

Known benign triggers

  • Database administrators and developers commonly use sqlcmd.exe legitimately for database management and scripting tasks within enterprise environments. These legitimate activities often include database backups and restores, schema deployment scripts, automated database maintenance, and ETL processes. However, it's important to note that some organizations may have no sqlcmd.exe usage at all, making any detection highly suspicious. To effectively manage false positives, organizations should whitelist known administrator accounts, create exceptions for approved script paths and output locations, and add legitimate usage patterns to the filter macro as needed. Recommend running this detection first as a hunt to review usage patterns. Following, modify the risk score and false positive list as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice