Disclosed hacktool set - file sql.exe

Hunt Hypothesis

This rule detects adversaries deploying a SQL-based hacking tool named sql.exe to establish persistence or execute malicious queries within the environment. Proactive hunting for this behavior in Azure Sentinel is critical because such tools are frequently used by threat actors to exfiltrate sensitive database information and maintain covert access, often evading standard signature-based defenses due to their legitimate appearance.

YARA Rule

rule Hacktools_CN_Burst_sql {
	meta:
		description = "Disclosed hacktool set - file sql.exe"
		author = "Florian Roth"
		date = "17.11.14"
		score = 60
		hash = "d5139b865e99b7a276af7ae11b14096adb928245"
	strings:
		$s0 = "s.exe %s %s %s %s %d /save" fullword ascii
		$s2 = "s.exe start error...%d" fullword ascii
		$s4 = "EXEC sp_addextendedproc xp_cmdshell,'xplog70.dll'" fullword ascii
		$s7 = "EXEC master..xp_cmdshell 'wscript.exe cc.js'" fullword ascii
		$s10 = "Result.txt" fullword ascii
		$s11 = "Usage:sql.exe [options]" fullword ascii
		$s17 = "%s root %s %d error" fullword ascii
		$s18 = "Pass.txt" fullword ascii
		$s20 = "SELECT sillyr_at_gmail_dot_com INTO DUMPFILE '%s\\\\sillyr_x.so' FROM sillyr_x" fullword ascii
	condition:
		6 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set - file sql.exe detection rule, including actionable filters and exclusions:

• Scenario: Scheduled Database Maintenance via SQL Server Agent

  • Context: The Microsoft SQL Server Agent service (SQLServerAgent) frequently executes maintenance plans (backups, index rebuilding) that spawn sql.exe processes to run T-SQL scripts or connect to the engine. In an enterprise environment, these are often scheduled nightly and trigger the detection due to the process name matching the hacktool signature.
  • Filter/Exclusion: Create a rule exclusion based on the parent process name. Exclude alerts where ParentProcessName is sqlagent.exe or SQLServerAgent. Additionally, filter by the specific file path: C:\Program Files\Microsoft SQL Server\MSSQL*\MSSQL\Binn\sql.exe.

• Scenario: Deployment Automation with PowerShell DSC or Ansible

  • Context: DevOps teams often use automation tools like Microsoft System Center Configuration Manager (SCCM), PowerShell Desired State Configuration (DSC), or Ansible to deploy database configurations. These tools may invoke sql.exe directly from a known deployment server to execute migration scripts (sqlcmd) during change windows.
  • Filter/Exclusion: Implement an exclusion based on the source host and user context. Exclude events originating from specific “Deployment Server” groups (e.g., HostGroup: DevOps-Servers) where the AccountName is a known service account like svc-deploy-sql.

• Scenario: Third-Party Backup Solutions Executing Native SQL Commands

  • Context: Enterprise backup suites such as Veeam, Commvault, or Rubrik often utilize native SQL client tools to perform transaction log backups or consistency checks. These agents may launch sql.exe as