Chinese Hacktool Set - file sqlcmd.exe

Hunt Hypothesis

This detection identifies adversaries leveraging the legitimate sqlcmd.exe utility as part of a Chinese threat actor’s hacktool set to execute database commands and maintain persistence within Azure environments. Proactive hunting is essential because while flagged with low severity, this behavior often indicates early-stage reconnaissance or lateral movement that could escalate into significant data exfiltration if not correlated with other suspicious activities.

YARA Rule

rule x_way2_5_sqlcmd {
	meta:
		description = "Chinese Hacktool Set - file sqlcmd.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "5152a57e3638418b0d97a42db1c0fc2f893a2794"
	strings:
		$s1 = "LOADER ERROR" fullword ascii
		$s2 = "The procedure entry point %s could not be located in the dynamic link library %s" fullword ascii
		$s3 = "The ordinal %u could not be located in the dynamic link library %s" fullword ascii
		$s4 = "kernel32.dll" fullword ascii
		$s5 = "VirtualAlloc" fullword ascii
		$s6 = "VirtualFree" fullword ascii
		$s7 = "VirtualProtect" fullword ascii
		$s8 = "ExitProcess" fullword ascii
		$s9 = "user32.dll" fullword ascii
		$s16 = "MessageBoxA" fullword ascii
		$s10 = "wsprintfA" fullword ascii
		$s11 = "kernel32.dll" fullword ascii
		$s12 = "GetProcAddress" fullword ascii
		$s13 = "GetModuleHandleA" fullword ascii
		$s14 = "LoadLibraryA" fullword ascii
		$s15 = "odbc32.dll" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 23KB and filesize > 20KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 16 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file sqlcmd.exe detection rule in an enterprise environment:

• Database Administration via Scheduled Maintenance Jobs

  • Scenario: Enterprise SQL Server maintenance tasks (e.g., index rebuilding, backup verification) are often automated using Windows Task Scheduler or SQL Agent. These jobs frequently invoke sqlcmd.exe to execute T-SQL scripts against production databases without user interaction.
  • Filter/Exclusion: Create an exclusion for processes where the parent process is TaskScheduler.exe (or SchedLgU.exe) and the command line contains specific maintenance keywords like -b, -Q, or references to known internal script paths (e.g., C:\Scripts\Maintenance\).

• CI/CD Pipeline Deployment Artifacts

  • Scenario: DevOps pipelines using tools like Jenkins, Azure DevOps, or GitLab CI often include database migration steps. During the “Release” phase, these agents execute sqlcmd.exe to apply schema changes (migration scripts) to staging and production environments as part of a standard deployment workflow.
  • Filter/Exclusion: Exclude instances where the parent process is a known build agent (e.g., java.exe for Jenkins, Microsoft.TeamFoundation.Build.Agent.exe) running under a dedicated service account (e.g., svc-ci-deploy) and the working directory matches the CI/CD artifact path.

• Third-Party Monitoring and Backup Solutions

  • Scenario: Enterprise monitoring suites like SolarWinds DPA, Datadog Agent, or backup solutions like Veeam utilize sqlcmd.exe to query database health metrics, check lock status, or validate transaction log integrity. These tools run continuously in the background, generating frequent sqlcmd executions that may lack