Windows: SQLCmd used to dump database metadata and backups
Alerts on Windows executions of sqlcmd.exe with local server targeting and database enumeration/backup query fragments.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-08-16
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where sqlcmd.exe is invoked with command-line arguments indicative of database discovery and backup-related activity. Attackers may use SQLCmd to collect information about SQL Server objects and databases and to prepare for or support data theft during ransomware operations. Detection relies on process creation telemetry containing the executable path and full command line, including specific system catalog and BACKUP DATABASE-related strings.
Reporting behind it
- twitter.comhttps://twitter.com/vxunderground/status/1423336151860002816?s=20
- virustotal.comhttps://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
- docs.microsoft.comhttps://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_database_dump.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: SQLCmd used to dump database metadata and backups"
id: 7a0cb558-9d48-4546-aa90-95efb0c6534d
status: test
description: This rule flags Windows process creation events where sqlcmd.exe is invoked with command-line arguments indicative of database discovery and backup-related activity. Attackers may use SQLCmd to collect information about SQL Server objects and databases and to prepare for or support data theft during ransomware operations. Detection relies on process creation telemetry containing the executable path and full command line, including specific system catalog and BACKUP DATABASE-related strings.
references:
- https://twitter.com/vxunderground/status/1423336151860002816?s=20
- https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
- https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_database_dump.yml
author: frack113, Huntrule Team
date: 2021-08-16
modified: 2023-05-04
tags:
- attack.collection
- attack.t1005
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_tools:
- Image|endswith: \sqlcmd.exe
- CommandLine|contains:
- "sqlcmd "
- sqlcmd.exe
selection_svr:
CommandLine|contains: " -S localhost "
selection_query:
CommandLine|contains:
- sys.sysprocesses
- master.dbo.sysdatabases
- BACKUP DATABASE
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 2f47f1fd-0901-466e-a770-3b7092834a1b
type: derived