Windows Process Creation: BCP.EXE Used to Export SQL Data
Flags Windows executions of bcp.exe where command-line options indicate MSSQL data export via out/queryout.
- Product
- windows
- Category
- process_creation
- Author
- Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-08-20
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of the bcp.exe utility on Windows where the command line includes export indicators for a table or a query. Attackers may use BCP to extract stored payloads or sensitive data from a Microsoft SQL Server into an external file. It relies on Windows process creation telemetry capturing the process image name and command-line arguments.
Reporting behind it
- docs.microsoft.comhttps://docs.microsoft.com/en-us/sql/tools/bcp-utility
- asec.ahnlab.comhttps://asec.ahnlab.com/en/61000/
- asec.ahnlab.comhttps://asec.ahnlab.com/en/78944/
- huntress.comhttps://www.huntress.com/blog/attacking-mssql-servers
- huntress.comhttps://www.huntress.com/blog/attacking-mssql-servers-pt-ii
- news.sophos.comhttps://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
- research.nccgroup.comhttps://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: BCP.EXE Used to Export SQL Data"
id: 83e5307b-de79-484a-8a96-9df897b967fc
status: test
description: This rule identifies executions of the bcp.exe utility on Windows where the command line includes export indicators for a table or a query. Attackers may use BCP to extract stored payloads or sensitive data from a Microsoft SQL Server into an external file. It relies on Windows process creation telemetry capturing the process image name and command-line arguments.
references:
- https://docs.microsoft.com/en-us/sql/tools/bcp-utility
- https://asec.ahnlab.com/en/61000/
- https://asec.ahnlab.com/en/78944/
- https://www.huntress.com/blog/attacking-mssql-servers
- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml
author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-08-20
tags:
- attack.execution
- attack.exfiltration
- attack.t1048
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \bcp.exe
- OriginalFileName: BCP.exe
selection_cli:
CommandLine|contains:
- " out "
- " queryout "
condition: all of selection_*
falsepositives:
- Legitimate data export operations.
level: medium
license: DRL-1.1
related:
- id: c615d676-f655-46b9-b913-78729021e5d7
type: derived