Data Export From MSSQL Table Via BCP.EXE

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•31

Detects the execution of the BCP utility to export data from a Microsoft SQL Server database. Attackers may use this method to extract malware previously saved into a database column or table, or to exfiltrate sensitive data from the database.