Windows SQLCmd Database Dumping Commands Indicative of Ransomware Activity

title: Windows SQLCmd Database Dumping Commands Indicative of Ransomware Activity
id: 7a0cb558-9d48-4546-aa90-95efb0c6534d
status: test
description: This rule flags process executions of sqlcmd.exe where the command line includes local server targeting and query patterns consistent with enumerating database internals and issuing BACKUP DATABASE operations. Attackers may use sqlcmd to automate database collection prior to impact, since direct SQL backup or metadata queries can accelerate data theft and ransomware workflows. Telemetry relies on Windows process creation events, matching on the executable path ending in sqlcmd.exe and specific substrings within the process command line.
references:
  - https://twitter.com/vxunderground/status/1423336151860002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
  - https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_database_dump.yml
author: frack113, Huntrule Team
date: 2021-08-16
modified: 2023-05-04
tags:
  - attack.collection
  - attack.t1005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    - Image|endswith: \sqlcmd.exe
    - CommandLine|contains:
        - "sqlcmd "
        - sqlcmd.exe
  selection_svr:
    CommandLine|contains: " -S localhost "
  selection_query:
    CommandLine|contains:
      - sys.sysprocesses
      - master.dbo.sysdatabases
      - BACKUP DATABASE
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2f47f1fd-0901-466e-a770-3b7092834a1b
    type: derived