PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

FreeUnreviewedSigmamediumv1

powershell-execution-via-sqlps-exe-windows-process-creation-0152550d

title: PowerShell Execution via sqlps.exe (Windows Process Creation)
id: 953d7f52-c32d-48f2-8471-153bae55dc03
status: test
description: This rule identifies PowerShell execution activity that uses sqlps.exe, a utility shipped with MSSQL Server. Attackers may use sqlps.exe to run PowerShell in a context where script-block logging is not captured, helping bypass defenses that rely on those logs. The detection relies on Windows process creation telemetry, matching sqlps.exe by image and parent process name, and excluding cases where sqlps.exe is spawned by sqlagent.exe.
references:
  - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/
  - https://twitter.com/bryon_/status/975835709587075072
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml
author: Agro (@agro_sev) oscd.community, Huntrule Team
date: 2020-10-10
modified: 2022-12-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \sqlps.exe
  selection_image:
    - Image|endswith: \sqlps.exe
    - OriginalFileName: sqlps.exe
  filter_image:
    ParentImage|endswith: \sqlagent.exe
  condition: selection_parent or (selection_image and not filter_image)
falsepositives:
  - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.
level: medium
license: DRL-1.1
related:
  - id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
    type: derived

What it detects

This rule identifies PowerShell execution activity that uses sqlps.exe, a utility shipped with MSSQL Server. Attackers may use sqlps.exe to run PowerShell in a context where script-block logging is not captured, helping bypass defenses that rely on those logs. The detection relies on Windows process creation telemetry, matching sqlps.exe by image and parent process name, and excluding cases where sqlps.exe is spawned by sqlagent.exe.

Known false positives

Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.