Windows Process Creation: BCP.EXE Used to Export SQL Data

Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2024-08-20
Updated: 2026-07-31

ATT&CK techniques

Exfiltration

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
- T1048Exfiltration Over Alternative Protocol
Impact

What it detects

This rule identifies executions of the bcp.exe utility on Windows where the command line includes export indicators for a table or a query. Attackers may use BCP to extract stored payloads or sensitive data from a Microsoft SQL Server into an external file. It relies on Windows process creation telemetry capturing the process image name and command-line arguments.

Reporting behind it

Related detections9 linkedT1048 — drag to rearrange

Suspicious Data Exfiltration via Blat SMTP Client (via process_creation)

Suspicious blat Utility Used for SMTP Data Exfiltration

Suspicious Data Exfiltration via WinSCP Command Line in BlackSuit Ransomware

Suspicious Scheduled Task Creation for rclone Exfiltration by The Gentlemen RaaS (via process_creation)

Suspicious DNS Query for Tor Onion Domain

Possible DNS Tunneling via Excessively Long Query Name

Malicious Bulk Data Exfiltration via Rclone (via process_creation)

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Windows Process Creation: BCP.EXE Used to Export SQL Data

Pivot detection · T1048 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-bcp-exe-data-export-from-mssql-c615d676

title: "Windows Process Creation: BCP.EXE Used to Export SQL Data"
id: 83e5307b-de79-484a-8a96-9df897b967fc
status: test
description: This rule identifies executions of the bcp.exe utility on Windows where the command line includes export indicators for a table or a query. Attackers may use BCP to extract stored payloads or sensitive data from a Microsoft SQL Server into an external file. It relies on Windows process creation telemetry capturing the process image name and command-line arguments.
references:
  - https://docs.microsoft.com/en-us/sql/tools/bcp-utility
  - https://asec.ahnlab.com/en/61000/
  - https://asec.ahnlab.com/en/78944/
  - https://www.huntress.com/blog/attacking-mssql-servers
  - https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
  - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
  - https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml
author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-08-20
tags:
  - attack.execution
  - attack.exfiltration
  - attack.t1048
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \bcp.exe
    - OriginalFileName: BCP.exe
  selection_cli:
    CommandLine|contains:
      - " out "
      - " queryout "
  condition: all of selection_*
falsepositives:
  - Legitimate data export operations.
level: medium
license: DRL-1.1
related:
  - id: c615d676-f655-46b9-b913-78729021e5d7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL