Disclosed hacktool set (old stuff) - file sqlcheck.exe

Hunt Hypothesis

This rule detects adversaries utilizing legacy or repurposed SQL analysis tools like sqlcheck.exe to establish persistence and conduct reconnaissance within the environment. Proactive hunting for this behavior is critical in Azure Sentinel to identify potential supply chain compromises or lateral movement attempts that may evade standard signature-based detections due to the tool’s historical legitimacy.

YARA Rule

rule sqlcheck {
	meta:
		description = "Disclosed hacktool set (old stuff) - file sqlcheck.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "5a5778ac200078b627db84fdc35bf5bcee232dc7"
	strings:
		$s0 = "Power by eyas<[email protected]>" fullword ascii
		$s3 = "\\ipc$ \"\" /user:\"\"" fullword ascii
		$s4 = "SQLCheck can only scan a class B network. Try again." fullword ascii
		$s14 = "Example: SQLCheck 192.168.0.1 192.168.0.254" fullword ascii
		$s20 = "Usage: SQLCheck <StartIP> <EndIP>" fullword ascii
	condition:
		3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Disclosed hacktool set (old stuff) - file sqlcheck.exe detection rule, including recommended filters and exclusions:

• Scenario: Legacy SQL Maintenance Scheduled Task

  • Context: A nightly scheduled task on a domain-joined SQL Server host runs sqlcheck.exe to validate database integrity and repair indexes. This is part of the standard maintenance window for older SQL versions (e.g., SQL 2016/2019) where this specific executable was bundled with the “SQL Server Management Tools” package.
  • Filter/Exclusion: Create a whitelist exclusion based on the file path and hash.
    • Path: C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqlcheck.exe (adjust version number as needed).
    • Condition: Exclude if the process parent is Task Scheduler (svchost.exe or taskscheduler.exe) and the file hash matches the known good SHA256 from the enterprise asset inventory.

• Scenario: Third-Party Backup Agent Execution

  • Context: An enterprise backup solution (e.g., Veeam or Commvault) utilizes a custom utility named sqlcheck.exe to pre-scan SQL databases before initiating a full backup job. This tool is installed in the backup agent’s directory and runs periodically during business hours.
  • Filter/Exclusion: Exclude based on the parent process name of the specific backup vendor.
    • Condition: If Parent Process Name equals VeeamBackupService.exe (or CommServe.exe) AND File Path contains \Program Files\BackupAgent\, suppress the alert.

• Scenario: Database Administrator Manual Ad-hoc Analysis *