LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Sqlps.exe

View source

Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.

COMMAND
Sqlps.exe -noprofile
USE CASE
Execute PowerShell commands without ScriptBlock logging.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · PowerShell
02 / ON DISK

Known paths

C:\Program files (x86)\Microsoft SQL Server\100\Tools\Binn\sqlps.exe
C:\Program files (x86)\Microsoft SQL Server\110\Tools\Binn\sqlps.exe
C:\Program files (x86)\Microsoft SQL Server\120\Tools\Binn\sqlps.exe
C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe
C:\Program Files (x86)\Microsoft SQL Server\150\Tools\Binn\SQLPS.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Bryon@bryon_
Manny@ManuelBerrueta