CL-STA-1062 OSQL.EXE SQL Query Dumping User Tables to Disk
Detects the use of OSQL.EXE to interact with Microsoft SQL Server databases and redirect query results—such as user tables or credential data—to files on disk. This activity is consistent with data collection and staging efforts used by threat actors to exfiltrate database contents.
Microsoft Sentinel (KQL)
