--- Name: Sqlps.exe Description: Execute, evade logging Author: '' Created: '2018-05-25' Categories: [] Commands: - Command: Sqlps.exe -noprofile Description: Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging. Full Path: - C:\Program files (x86)\Microsoft SQL Server\100\Tools\Binn\sqlps.exe (SQL Server 2008 R2 - PS version 2.0) - C:\Program files (x86)\Microsoft SQL Server\110\Tools\Binn\sqlps.exe (SQL Server 2012 - PS version 2.0) - C:\Program files (x86)\Microsoft SQL Server\120\Tools\Binn\sqlps.exe (SQL Server 2014 - PS version 4.0) - C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe (SQL Server 2016 - PS version 4.0) Code Sample: [] Detection: [] Resources: - https://twitter.com/bryon_/status/975835709587075072 - https://twitter.com/_castleinthesky/status/101232247501798196 - https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017 Notes: - Thanks to Bryon - @bryon_ - Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons