LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Bcp.exe

View source

Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Export binary payload stored in SQL Server database to file system.

COMMAND
bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -c
USE CASE
Extract malicious executable from database storage to local file system for execution.
PRIVILEGES
User
OPERATING SYSTEM
Windows
02 / ON DISK

Known paths

C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\bcp.exe
C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\130\Tools\Binn\bcp.exe
C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\110\Tools\Binn\bcp.exe
C:\Program Files (x86)\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\bcp.exe
C:\Program Files (x86)\Microsoft SQL Server\Client SDK\ODBC\130\Tools\Binn\bcp.exe
C:\Program Files (x86)\Microsoft SQL Server\Client SDK\ODBC\110\Tools\Binn\bcp.exe
C:\Program Files (x86)\Microsoft SQL Server\120\Tools\Binn\bcp.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Process creation of bcp.exe with queryout or Out parameter

  • IOC

    bcp.exe writing executable files to temp or users directories

  • IOC

    Network connections from bcp.exe to SQL Server followed by file creation

  • IOC

    Event ID 4688 - Process creation for bcp.exe

  • IOC

    Event ID 4663 - File system access by bcp.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Mahir Ali Khan@mahiralikhan07