
title: SQL Client Tools PowerShell Session Detection
author: Agro (@agro_sev) oscd.communitly
date: 2020/10/13
description: This rule detects execution of a PowerShell code through the sqltoolsps.exe
  utility, which is included in the standard set of utilities supplied with the Microsoft
  SQL Server Management studio. Script blocks are not logged in this case, so this
  utility helps to bypass protection mechanisms based on the analysis of these logs.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\sqltoolsps.exe'
  SELECTION_3:
    ParentImage: '*\sqltoolsps.exe'
  SELECTION_4:
    OriginalFileName: \sqltoolsps.exe
  SELECTION_5:
    ParentImage: '*\smss.exe'
  condition: (SELECTION_1 and ((SELECTION_2 or SELECTION_3) or (SELECTION_4 and  not
    (SELECTION_5))))
falsepositives:
- Direct PS command execution through SQLToolsPS.exe is uncommon, childprocess sqltoolsps.exe
  spawned by smss.exe is a legitimate action.
id: a746c9b8-a2fb-4ee5-a428-92bee9e99060
level: medium
logsource:
  category: process_creation
  product: windows
references:
- https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Sqltoolsps.yml
- https://twitter.com/pabraeken/status/993298228840992768
status: experimental
tags:
- attack.execution
- attack.t1059.001
- attack.defense_evasion
- attack.t1127
ruletype: SIGMA
