SQL Client Tools PowerShell Session Detection
This rule detects the execution of PowerShell code through the `sqltoolsps.exe` utility, which is part of Microsoft SQL Server Management Studio. This method can be used to bypass logging mechanisms for script blocks, making it a technique for defense evasion.
Sigma
