Attack.t1127 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/attack.t1127/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 03:53:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMicrosoft SQL Server: Potential execution via sqltoolsps.exehttps://feed.craftedsignal.io/briefs/2026-11-sql-tools-powershell/Wed, 04 Nov 2026 03:53:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-sql-tools-powershell/The sqltoolsps.exe utility, a component of Microsoft SQL Server Management Studio, can be used to execute PowerShell code. Script blocks are not logged in this case, allowing this utility to bypass protection mechanisms based on log analysis.<p>The utility sqltoolsps.exe is included with Microsoft SQL Server Management Studio. This binary can be used to execute PowerShell code. Because script blocks are not logged during execution via this utility, it serves as a mechanism to bypass log-based protection mechanisms.</p> mediumadvisoryattack.executionattack.stealthattack.t1059.001attack.t1127