CL-STA-1062 MSSQL DB Dump via osql/sqlcmd with Output Redirection from Web Shell

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects the use of osql.exe or sqlcmd.exe to query database schema information (such as sys.objects, sys.tables, or INFORMATION_SCHEMA) with output redirected to a file. This behavior is flagged when launched from non-standard parent processes, specifically those commonly associated with web shell activity like w3wp.exe, suggesting post-exploitation database discovery.