Bcp.exe

Export binary payload stored in SQL Server database to file system.

Use Extract malicious executable from database storage to local file system for execution.

bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -c

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

IOC: Process creation of bcp.exe with queryout or Out parameter

IOC: bcp.exe writing executable files to temp or users directories

IOC: Network connections from bcp.exe to SQL Server followed by file creation

IOC: Event ID 4688 - Process creation for bcp.exe

IOC: Event ID 4663 - File system access by bcp.exe

Sigma: github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml

Refs

docs.microsoft.com/en-us/sql/tools/bcp-utility

asec.ahnlab.com/en/61000/

asec.ahnlab.com/en/78944/

www.huntress.com/blog/attacking-mssql-servers

www.huntress.com/blog/attacking-mssql-servers-pt-ii

news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/

research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/

lolbas-project.github.io/lolbas/OtherMSBinaries/Bcp/