Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files. Located at: C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\bcp.exe; C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\130\Tools\Binn\bcp.exe; C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\110\Tools\Binn\bcp.exe.
bcpbcpSandbox: execFile · Timeout: 30s
network.transfer.download Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Export binary payload stored in SQL Server database to file system. (Extract malicious executable from database storage to local file system for execution.)
bcp "SELECT payload_data FROM database.dbo.payloads WHERE id=1" queryout "C:\Windows\Temp\payload.exe" -S localhost -T -c| Type | Rule / Indicator |
|---|---|
| ioc | Process creation of bcp.exe with queryout or Out parameter |
| ioc | bcp.exe writing executable files to temp or users directories |
| ioc | Network connections from bcp.exe to SQL Server followed by file creation |
| ioc | Event ID 4688 - Process creation for bcp.exe |
| ioc | Event ID 4663 - File system access by bcp.exe |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcp_export_data.yml |
bcp is a Windows LOLBin. Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files. Located at: C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\170\Tools\Binn\bcp.exe; C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\130\Tools\Binn\bcp.exe; C:\Program Files\Microsoft SQL Server\Client SDK\ODBC\110\Tools\Binn\bcp.exe.