.. / SQLToolsPS.exe
Star

Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.


Paths:


Resources:
https://twitter.com/pabraeken/status/993298228840992768
https://docs.microsoft.com/en-us/sql/powershell/sql-server-powershell?view=sql-server-2017

Acknowledgement:
Pierre-Alexandre Braeken - @pabraeken


Detection:



Execute

Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.
SQLToolsPS.exe -noprofile -command Start-Process calc.exe
Usecase:Execute PowerShell command.
Privileges required:User
OS:Windows
Mitre:T1218