← Back to SOC feed Coverage →

osql tool

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-07-09T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies adversaries leveraging the osql command-line utility to execute SQL queries or scripts, a behavior often associated with reconnaissance and lateral movement within database-rich environments. Proactively hunting for this activity in Azure Sentinel is critical because legitimate administrative use of osql can mask malicious data exfiltration attempts that might otherwise go unnoticed due to the tool’s low-severity classification.

YARA Rule

rule osql_tool
{
meta:
	author = "@patrickrolsen"
	reference = "O/I SQL - SQL query tool"
	filetype = "EXE"
	version = "0.1"
	date = "1/30/2014"
strings:
	$s1 = "osql\\src"
	$s2 = "OSQLUSER"
	$s3 = "OSQLPASSWORD"
	$s4 = "OSQLSERVER"
condition:
	uint16(0) == 0x5A4D and (all of ($s*))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 4 string patterns in its detection logic.

References

False Positive Guidance

Here are 5 specific false positive scenarios for the osql tool detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/POS.yar