OSQL.EXE Used to Dump Database User Tables to Disk for Exfiltration

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the use of the legacy osql.exe command-line tool to execute SQL queries against a local SQL server. This behavior is often associated with automated maintenance tasks but can be abused by adversaries for data discovery or exfiltration.