LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

SQLToolsPS.exe

View source

Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
02DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.

COMMAND
SQLToolsPS.exe -noprofile -command Start-Process {PATH:.exe}
USE CASE
Execute PowerShell command.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · PowerShell
02 / ON DISK

Known paths

C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Pierre-Alexandre Braeken@pabraeken