{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/attack.t1127/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1127"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe utility sqltoolsps.exe is included with Microsoft SQL Server Management Studio. This binary can be used to execute PowerShell code. Because script blocks are not logged during execution via this utility, it serves as a mechanism to bypass log-based protection mechanisms.\u003c/p\u003e\n","date_modified":"2026-11-04T03:53:51Z","date_published":"2026-11-04T03:53:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-sql-tools-powershell/","summary":"The sqltoolsps.exe utility, a component of Microsoft SQL Server Management Studio, can be used to execute PowerShell code. Script blocks are not logged in this case, allowing this utility to bypass protection mechanisms based on log analysis.","title":"Microsoft SQL Server: Potential execution via sqltoolsps.exe","url":"https://feed.craftedsignal.io/briefs/2026-11-sql-tools-powershell/"}],"language":"en","title":"CraftedSignal Threat Feed - Attack.t1127","version":"https://jsonfeed.org/version/1.1"}