medium
advisory
Microsoft SQL Server: Potential execution via sqltoolsps.exe
The sqltoolsps.exe utility, a component of Microsoft SQL Server Management Studio, can be used to execute PowerShell code. Script blocks are not logged in this case, allowing this utility to bypass protection mechanisms based on log analysis.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 4, 03:53 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
The utility sqltoolsps.exe is included with Microsoft SQL Server Management Studio. This binary can be used to execute PowerShell code. Because script blocks are not logged during execution via this utility, it serves as a mechanism to bypass log-based protection mechanisms.
Detection coverage 1
Detect SQL Client Tools PowerShell Session Execution
mediumsigma
sources: process_creation, windows
Detection queries are available on the platform. Get full rules →