Chinese Hacktool Set - file Sqlcmd.exe

Hunt Hypothesis

This detection identifies adversaries leveraging the legitimate sqlcmd.exe utility to execute database commands or exfiltrate data, a tactic frequently observed in Chinese threat actor campaigns utilizing living-off-the-land techniques. Proactive hunting for this behavior within Azure Sentinel is essential because low-severity alerts often mask sophisticated, stealthy reconnaissance activities that bypass standard signature-based defenses by relying on trusted system binaries.

YARA Rule

rule tools_Sqlcmd {
	meta:
		description = "Chinese Hacktool Set - file Sqlcmd.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "99d56476e539750c599f76391d717c51c4955a33"
	strings:
		$s0 = "[Usage]:  %s <HostName|IP> <UserName> <Password>" fullword ascii
		$s1 = "=============By uhhuhy(Feb 18,2003) - http://www.cnhonker.net=============" fullword ascii /* PEStudio Blacklist: os */
		$s4 = "Cool! Connected to SQL server on %s successfully!" fullword ascii
		$s5 = "EXEC master..xp_cmdshell \"%s\"" fullword ascii
		$s6 = "=======================Sqlcmd v0.21 For HScan v1.20=======================" fullword ascii
		$s10 = "Error,exit!" fullword ascii
		$s11 = "Sqlcmd>" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 40KB and 3 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file Sqlcmd.exe detection rule, including suggested filters and exclusions:

• SQL Server Maintenance Scripts via Scheduled Tasks

  • Scenario: Enterprise Database Administrators often configure Windows Scheduled Tasks to run nightly backup verification or index rebuilding scripts. These tasks frequently invoke Sqlcmd.exe (e.g., C:\Windows\System32\sqlcmd.exe) with specific connection strings and input files (.sql) to execute maintenance commands without user interaction.
  • Filter/Exclusion: Create an exclusion for processes where the parent process is TaskScheduler.exe or svchost.exe, specifically targeting the path C:\Windows\System32\sqlcmd.exe. Additionally, filter out executions containing known maintenance arguments like -b (batch mode) or specific database names associated with internal maintenance jobs.

• CI/CD Pipeline Deployment Agents

  • Scenario: In DevOps environments, build agents (such as Jenkins, Azure DevOps Agents, or GitHub Actions runners) execute deployment pipelines that include database schema updates. These agents often call Sqlcmd.exe to run migration scripts against staging or production SQL instances during the “Deploy” phase of a pipeline.
  • Filter/Exclusion: Exclude executions where the parent process is a known CI/CD agent service (e.g., Jenkins.exe, VSTS.Agent.exe, or GitHub Actions Runner). You can also filter by the user context, excluding accounts named SYSTEM or specific service accounts like svc-build-agent-01 that are restricted to the build server subnet.

• Third-Party Monitoring and Backup Solutions

  • Scenario: Enterprise monitoring tools (like SolarWinds Database Performance Analyzer) or backup suites (such as Veeam or Commvault) utilize Sqlcmd.exe internally to