Windows Process Execution: bcp.exe Data Export From MSSQL

Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.

FreeUnreviewedSigmamediumv1

windows-process-execution-bcp-exe-data-export-from-mssql-c615d676

title: "Windows Process Execution: bcp.exe Data Export From MSSQL"
id: 83e5307b-de79-484a-8a96-9df897b967fc
status: test
description: This rule identifies execution of the BCP utility (bcp.exe/BCP.exe) with command-line arguments consistent with exporting SQL Server data to a file. Attackers commonly use BCP to extract stored content from database tables or columns as part of exfiltration. It relies on Windows process creation telemetry, matching the executable name and command-line substrings such as 'out' and 'queryout'.
references:
  - https://docs.microsoft.com/en-us/sql/tools/bcp-utility
  - https://asec.ahnlab.com/en/61000/
  - https://asec.ahnlab.com/en/78944/
  - https://www.huntress.com/blog/attacking-mssql-servers
  - https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
  - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
  - https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml
author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-08-20
tags:
  - attack.execution
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bcp.exe
    - OriginalFileName: BCP.exe
  selection_cli:
    CommandLine|contains:
      - " out "
      - " queryout "
  condition: all of selection_*
falsepositives:
  - Legitimate data export operations.
level: medium
license: DRL-1.1
related:
  - id: c615d676-f655-46b9-b913-78729021e5d7
    type: derived

What it detects

This rule identifies execution of the BCP utility (bcp.exe/BCP.exe) with command-line arguments consistent with exporting SQL Server data to a file. Attackers commonly use BCP to extract stored content from database tables or columns as part of exfiltration. It relies on Windows process creation telemetry, matching the executable name and command-line substrings such as 'out' and 'queryout'.

Known false positives

Legitimate data export operations.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.