CmdID

CmdID / Files

SQLCMD.EXE

T-SQL execution command line utility file version info

Program on Windows 1 known copy with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SQLCMD.EXE?

file version info and known copies
Installed inC:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\
Signed byMicrosoft Corporation
ProductMicrosoft SQL Server, Microsoft Corporation
DescriptionT-SQL execution command line utility

1 known copy

2019.0150.2000.05 ((SQLServer).190924-2033) · C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\SQLCMD.EXE · signed by Microsoft Corporation

5803521cd1a53b4de33e7bb782651548c22d1d81c0c1c6b26b1eb9cf773bb724

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SQLCMD.EXE
highPotential Conti Ransomware Database Dumping Activity Via SQLCmdfrack113
highVeeamBackup Database Credentials Dump Via Sqlcmd.EXEfrack113
mediumVeeam Backup Database Suspicious QueryNasreddine Bencherchali (Nextron Systems)