PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Agro (@agro_sev) oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-10
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1127Trusted Developer Utilities Proxy Execution
Persistence
Priv Esc
Defense Evasion
- T1127Trusted Developer Utilities Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell execution activity that uses sqlps.exe, a utility shipped with MSSQL Server. Attackers may use sqlps.exe to run PowerShell in a context where script-block logging is not captured, helping bypass defenses that rely on those logs. The detection relies on Windows process creation telemetry, matching sqlps.exe by image and parent process name, and excluding cases where sqlps.exe is spawned by sqlagent.exe.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows PowerShell via sqltoolsps.exe (sqltoolsps.exe child process exclusion)

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious PowerShell Archive Extraction to AppData Roaming

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

Suspicious PowerShell Spawned by cscript in Script Chain

PowerShell Execution via sqlps.exe (Windows Process Creation)

Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-execution-via-sqlps-exe-windows-process-creation-0152550d

title: PowerShell Execution via sqlps.exe (Windows Process Creation)
id: 953d7f52-c32d-48f2-8471-153bae55dc03
status: test
description: This rule identifies PowerShell execution activity that uses sqlps.exe, a utility shipped with MSSQL Server. Attackers may use sqlps.exe to run PowerShell in a context where script-block logging is not captured, helping bypass defenses that rely on those logs. The detection relies on Windows process creation telemetry, matching sqlps.exe by image and parent process name, and excluding cases where sqlps.exe is spawned by sqlagent.exe.
references:
  - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/
  - https://twitter.com/bryon_/status/975835709587075072
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml
author: Agro (@agro_sev) oscd.community, Huntrule Team
date: 2020-10-10
modified: 2022-12-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: \sqlps.exe
  selection_image:
    - Image|endswith: \sqlps.exe
    - OriginalFileName: sqlps.exe
  filter_image:
    ParentImage|endswith: \sqlagent.exe
  condition: selection_parent or (selection_image and not filter_image)
falsepositives:
  - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.
level: medium
license: DRL-1.1
related:
  - id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL