CL-STA-1062 OSQL.EXE SQL Server Table Dump to Disk
Detects the execution of OSQL.EXE to perform a database table dump to a file on the local system. The rule specifically monitors for OSQL connecting to a local SQL instance (localhost or 127.0.0.1) and utilizing the output flag (-o) to save query results to a file with a .sql extension, which is a common indicator of unauthorized data staging or collection.
YARA-L
