CL-STA-1062 OSQL.EXE Database Dump to Local Disk for Exfiltration

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•2

Detects execution of the OSQL.EXE utility with command-line arguments indicative of database enumeration or unauthorized file operations, specifically targeting local SQL server instances.