CL-STA-1062 OSQL.EXE SQL Database Dump to Disk via Web Shell

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects the use of the legacy OSQL.exe utility to connect to a local SQL server instance and execute a query that writes output to a file. This behavior is indicative of manual data discovery or exfiltration from a local database.