OSQL.EXE SQL Server query with output file for data exfiltration staging

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•1

Detects suspicious usage of the OSQL.EXE command-line utility, often associated with database enumeration or interaction. The rule identifies instances where OSQL queries local databases for user information, exports results to file paths, or is executed from suspicious parent processes like web shells (w3wp.exe or cmd.exe).