LOLBAS/yml/OtherMSBinaries/Sqlps.yml

---
Name: Sqlps.exe
Description: Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
Author: 'Oddvar Moe'
Created: 2018-05-25
Commands:
  - Command: Sqlps.exe -noprofile
    Description: Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.
    Usecase: Execute PowerShell commands without ScriptBlock logging.
    Category: Execute
    Privileges: User
    MitreID: T1218
    OperatingSystem: Windows
Full_Path:
  - Path: C:\Program files (x86)\Microsoft SQL Server\100\Tools\Binn\sqlps.exe
  - Path: C:\Program files (x86)\Microsoft SQL Server\110\Tools\Binn\sqlps.exe
  - Path: C:\Program files (x86)\Microsoft SQL Server\120\Tools\Binn\sqlps.exe
  - Path: C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe
  - Path: C:\Program Files (x86)\Microsoft SQL Server\150\Tools\Binn\SQLPS.exe
Code_Sample:
  - Code:
Detection:
  - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml
  - Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml
  - Elastic: https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/execution_suspicious_powershell_imgload.toml
  - Splunk: https://github.com/splunk/security_content/blob/aa9f7e0d13a61626c69367290ed1b7b71d1281fd/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
Resources:
  - Link: https://twitter.com/ManuelBerrueta/status/1527289261350760455
  - Link: https://twitter.com/bryon_/status/975835709587075072
  - Link: https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017
Acknowledgement:
  - Person: Bryon
    Handle: '@bryon_'
  - Person: Manny
    Handle: '@ManuelBerrueta'
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`---`
			`Name: Sqlps.exe`
Converted pull request from keepwatch into yml format. Original request here: https://github.com/LOLBAS-Project/LOLBAS/pull/19 - Thanks for contributing 2018-12-12 12:56:53 +01:00			`Description: Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Author: 'Oddvar Moe'`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Created: 2018-05-25`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`Commands:`
			`- Command: Sqlps.exe -noprofile`
Converted pull request from keepwatch into yml format. Original request here: https://github.com/LOLBAS-Project/LOLBAS/pull/19 - Thanks for contributing 2018-12-12 12:56:53 +01:00			`Description: Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Usecase: Execute PowerShell commands without ScriptBlock logging.`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`Category: Execute`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Privileges: User`
			`MitreID: T1218`
			`OperatingSystem: Windows`
Major changes to Web portal - Small fixes to source files to adjust 2018-12-10 14:28:12 +01:00			`Full_Path:`
Update Sqlps.yml Minor Typo Fix 2018-12-11 15:38:39 +01:00			`- Path: C:\Program files (x86)\Microsoft SQL Server\100\Tools\Binn\sqlps.exe`
Converted pull request from keepwatch into yml format. Original request here: https://github.com/LOLBAS-Project/LOLBAS/pull/19 - Thanks for contributing 2018-12-12 12:56:53 +01:00			`- Path: C:\Program files (x86)\Microsoft SQL Server\110\Tools\Binn\sqlps.exe`
			`- Path: C:\Program files (x86)\Microsoft SQL Server\120\Tools\Binn\sqlps.exe`
			`- Path: C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe`
Updated yml/OtherMSBinaries/Sqlps.yml, used recently in a campaign shared my Microsoft Security Intelligence. Would be useful reference for Red Teamers/Offensive Security Engineers as well as Blue Teamers/Defenders who reference this open source project/library. 2022-05-19 16:12:37 +02:00			`- Path: C:\Program Files (x86)\Microsoft SQL Server\150\Tools\Binn\SQLPS.exe`
Major changes to Web portal - Small fixes to source files to adjust 2018-12-10 14:28:12 +01:00			`Code_Sample:`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`- Code:`
			`Detection:`
$frack113$ Update old sigma link (#303) * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> 2023-10-18 17:30:34 +02:00			`- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml`
			`- Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml`
Detection Resources and Other Updates (#179) * Add detection links for scripts * Add detection links for OtherMSBins. Fixed and updated as needed. * Add detection links for MSBins. Fixed and updated as needed. * Add detection links for oslibraries * Updating template for Detections * Removing empty Detection:Sigma entries * Remove redundant blank line * Replacing commit URL with file URL Co-authored-by: root <root@DESKTOP-5CR935D.localdomain> Co-authored-by: Wietze <wietze@users.noreply.github.com> 2021-11-15 14:19:03 +01:00			`- Elastic: https://github.com/elastic/detection-rules/blob/5bdf70e72c6cd4547624c521108189af994af449/rules/windows/execution_suspicious_powershell_imgload.toml`
			`- Splunk: https://github.com/splunk/security_content/blob/aa9f7e0d13a61626c69367290ed1b7b71d1281fd/docs/_posts/2021-10-05-suspicious_copy_on_system32.md`
Initial commit - LOLBAS V2.0 2018-06-09 00:15:06 +02:00			`Resources:`
Updated yml/OtherMSBinaries/Sqlps.yml, used recently in a campaign shared my Microsoft Security Intelligence. Would be useful reference for Red Teamers/Offensive Security Engineers as well as Blue Teamers/Defenders who reference this open source project/library. 2022-05-19 16:12:37 +02:00			`- Link: https://twitter.com/ManuelBerrueta/status/1527289261350760455`
Update scripts with new template. Fixed mgmt script for webportal. Adjustments to existing yml files 2018-09-26 11:41:58 +02:00			`- Link: https://twitter.com/bryon_/status/975835709587075072`
Converted pull request from keepwatch into yml format. Original request here: https://github.com/LOLBAS-Project/LOLBAS/pull/19 - Thanks for contributing 2018-12-12 12:56:53 +01:00			`- Link: https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017`
Completed template update of OterMSBinaries 2018-09-22 04:58:00 +02:00			`Acknowledgement:`
			`- Person: Bryon`
			`Handle: '@bryon_'`
Updated yml/OtherMSBinaries/Sqlps.yml, used recently in a campaign shared my Microsoft Security Intelligence. Would be useful reference for Red Teamers/Offensive Security Engineers as well as Blue Teamers/Defenders who reference this open source project/library. 2022-05-19 16:12:37 +02:00			`- Person: Manny`
			`Handle: '@ManuelBerrueta'`