Database client launched by a script host or Office parent

Siemphony@siemphonymediumT1213.006unverifiedPlaybook · Collection and exfiltration

Matches execution of a command-line database client — the SQL Server, MySQL, PostgreSQL, MongoDB, Oracle and SQLite tools — when its parent is one of the processes MITRE calls out in this analytic as an odd launcher: explorer.exe (an interactive double-click rather than automation), a script host, or an Office application. Both halves sit on a single field each so the rule stays a flat AND and renders in every backend. cmd.exe is deliberately absent from the parent list: it is the normal path for scheduled backup and ETL batch jobs, and including it would drown the rule. The analytic's full behaviour is a correlation — client execution, then a .sql/.bak/.csv write, then an outbound transfer above MaxTransferVolume — which Sigma cannot express across three log sources with a time window, so this is the execution precursor only. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0242, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Database client launched by a script host or Office parent2id: 1c8dda6a-ce4a-4877-98c2-8d7373cf33dd3status: experimental4description: |5  Matches execution of a command-line database client — the SQL Server, MySQL,6  PostgreSQL, MongoDB, Oracle and SQLite tools — when its parent is one of the7  processes MITRE calls out in this analytic as an odd launcher: explorer.exe8  (an interactive double-click rather than automation), a script host, or an9  Office application. Both halves sit on a single field each so the rule stays a10  flat AND and renders in every backend. cmd.exe is deliberately absent from the11  parent list: it is the normal path for scheduled backup and ETL batch jobs, and12  including it would drown the rule. The analytic's full behaviour is a13  correlation — client execution, then a .sql/.bak/.csv write, then an outbound14  transfer above MaxTransferVolume — which Sigma cannot express across three log15  sources with a time window, so this is the execution precursor only.16  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0242, not hand-written and not tested by its author. Any lab result is on this rule's own page.17references:18  - https://attack.mitre.org/techniques/T1213/00619  - https://attack.mitre.org/detectionstrategies/DET024220author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)21date: 2026-08-1622tags:23  - attack.collection24  - attack.t1213.00625logsource:26  category: process_creation27  product: windows28detection:29  selection_client:30    Image|endswith:31      - '\sqlcmd.exe'32      - '\osql.exe'33      - '\isql.exe'34      - '\bcp.exe'35      - '\sqlps.exe'36      - '\sqlplus.exe'37      - '\mysql.exe'38      - '\mysqldump.exe'39      - '\psql.exe'40      - '\pg_dump.exe'41      - '\mongo.exe'42      - '\mongosh.exe'43      - '\mongodump.exe'44      - '\sqlite3.exe'45  selection_parent:46    ParentImage|endswith:47      - '\explorer.exe'48      - '\powershell.exe'49      - '\pwsh.exe'50      - '\wscript.exe'51      - '\cscript.exe'52      - '\mshta.exe'53      - '\rundll32.exe'54      - '\winword.exe'55      - '\excel.exe'56      - '\outlook.exe'57  condition: selection_client and selection_parent58falsepositives:59  - "Scheduled backup, ETL and reporting jobs written in PowerShell that shell out to sqlcmd.exe, bcp.exe or mysqldump.exe. MITRE's KnownDBToolPaths knob is the intended place to record where the sanctioned tools live and which service accounts run them, and that inventory is site-specific."60  - "A DBA or developer starting a client interactively from Explorer on a workstation where the tools are installed under a user profile rather than Program Files — the same KnownDBToolPaths knob, seen from the noisy side."61  - "Excel or Access refresh of an external data connection, where the Office process is the parent of a client or bulk-copy helper during a routine report refresh."62  - "Vendor installers and application health checks that run sqlcmd.exe against a local instance during setup or upgrade, launched from a bootstrap script host."63level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\sqlcmd.exe" or FolderPath endswith "\\osql.exe" or FolderPath endswith "\\isql.exe" or FolderPath endswith "\\bcp.exe" or FolderPath endswith "\\sqlps.exe" or FolderPath endswith "\\sqlplus.exe" or FolderPath endswith "\\mysql.exe" or FolderPath endswith "\\mysqldump.exe" or FolderPath endswith "\\psql.exe" or FolderPath endswith "\\pg_dump.exe" or FolderPath endswith "\\mongo.exe" or FolderPath endswith "\\mongosh.exe" or FolderPath endswith "\\mongodump.exe" or FolderPath endswith "\\sqlite3.exe") and (InitiatingProcessFolderPath endswith "\\explorer.exe" or InitiatingProcessFolderPath endswith "\\powershell.exe" or InitiatingProcessFolderPath endswith "\\pwsh.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe" or InitiatingProcessFolderPath endswith "\\mshta.exe" or InitiatingProcessFolderPath endswith "\\rundll32.exe" or InitiatingProcessFolderPath endswith "\\winword.exe" or InitiatingProcessFolderPath endswith "\\excel.exe" or InitiatingProcessFolderPath endswith "\\outlook.exe"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\sqlcmd.exe" OR Image="*\\osql.exe" OR Image="*\\isql.exe" OR Image="*\\bcp.exe" OR Image="*\\sqlps.exe" OR Image="*\\sqlplus.exe" OR Image="*\\mysql.exe" OR Image="*\\mysqldump.exe" OR Image="*\\psql.exe" OR Image="*\\pg_dump.exe" OR Image="*\\mongo.exe" OR Image="*\\mongosh.exe" OR Image="*\\mongodump.exe" OR Image="*\\sqlite3.exe") AND (ParentImage="*\\explorer.exe" OR ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe" OR ParentImage="*\\mshta.exe" OR ParentImage="*\\rundll32.exe" OR ParentImage="*\\winword.exe" OR ParentImage="*\\excel.exe" OR ParentImage="*\\outlook.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\sqlcmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\osql.exe" OR TO_LOWER(process.executable) LIKE "*\\\\isql.exe" OR TO_LOWER(process.executable) LIKE "*\\\\bcp.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sqlps.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sqlplus.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mysql.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mysqldump.exe" OR TO_LOWER(process.executable) LIKE "*\\\\psql.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pg_dump.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mongo.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mongosh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mongodump.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sqlite3.exe") AND (TO_LOWER(process.parent.executable) LIKE "*\\\\explorer.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\rundll32.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\winword.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\excel.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\outlook.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\sqlcmd\.exe$|\\osql\.exe$|\\isql\.exe$|\\bcp\.exe$|\\sqlps\.exe$|\\sqlplus\.exe$|\\mysql\.exe$|\\mysqldump\.exe$|\\psql\.exe$|\\pg_dump\.exe$|\\mongo\.exe$|\\mongosh\.exe$|\\mongodump\.exe$|\\sqlite3\.exe$)</field>    <field name="ParentImage" type="pcre2">(?i)(\\explorer\.exe$|\\powershell\.exe$|\\pwsh\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\mshta\.exe$|\\rundll32\.exe$|\\winword\.exe$|\\excel\.exe$|\\outlook\.exe$)</field>    <description>Database client launched by a script host or Office parent</description>    <mitre>      <id>T1213.006</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1c8dda6a-ce4a-4877-98c2-8d7373cf33dd

ATT&CKT1213.006

T1213.006Databases

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1213.006, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `KnownDBToolPaths` knob is the intended home for the sanctioned
Decide the PowerShell question and be honest either way: exclude
Drop the Office parents unless you have a concrete reason to keep them.
Two evasions to keep in view. Run the client from cmd.exe — a parent this
Knobs that could not be implemented: `ExportExtensionPatterns` (needs the

Declared by the author

Scheduled backup, ETL and reporting jobs written in PowerShell that shell out to sqlcmd.exe, bcp.exe or mysqldump.exe. MITRE's KnownDBToolPaths knob is the intended place to record where the sanctioned tools live and which service accounts run them, and that inventory is site-specific.
A DBA or developer starting a client interactively from Explorer on a workstation where the tools are installed under a user profile rather than Program Files — the same KnownDBToolPaths knob, seen from the noisy side.
Excel or Access refresh of an external data connection, where the Office process is the parent of a client or bulk-copy helper during a routine report refresh.
Vendor installers and application health checks that run sqlcmd.exe against a local instance during setup or upgrade, launched from a bootstrap script host.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

A command-line database client starting on Windows when its parent is an interactive shell, a script host or an Office application. MITRE's AN0677 describes the full behaviour as a sequence: "Database client execution ... by users or from locations not tied to enterprise automation or backups. Often followed by creation of .sql/.bak/.csv files ... plus file writes in user temp locations." Client execution, then a dump file, then an outbound transfer above MaxTransferVolume. Three log sources and a time window. Sigma joins none of that, so what is written here is stage one. Be clear with yourself about what that means. T1213.006 is Collection — the technique is mining data out of a database. This rule observes only that a client process started with an unusual parent. It carries no evidence of a query, an export or a volume. The defining act is the dump; the .sql/.bak/.csv write on the brief's file_event log source is where the technique actually becomes observable, and it is not modelled.

02 · Telemetry you need

category: process_creation, product: windows, verbatim from AN0677, whose
Two fields: Image and ParentImage.
Not used, and it matters: Sysmon EID 11 for the dump file, EID 3 for the

03 · How the logic works

Why the AND is the rule. selection_client alone fires on every legitimate DBA and every backup job in the estate — database clients are supposed to run. selection_parent alone is meaningless. The signal claimed here is entirely in the lineage: a database client is normal, a database client born of a Word document is not. Both halves sit on one field each, which keeps the rule a flat AND. That is what lets Wazuh render it — Wazuh's XML model is a conjunction of <field> tests, so an OR spread across two different fields would have been refused. Check the attribution. rule.yml says the parents are "the processes MITRE calls out in this analytic as an odd launcher: explorer.exe ..., a script host, or an Office application." AN0677 names explorer.exe and PowerShell. The script hosts and all three Office applications are the author's additions, presented as MITRE's. This is the exact failure the authoring contract warns about, and the reviewer flagged it — compare the T1548.002 rule, which writes "and the closely related" and stays honest. The rule contradicts its own rationale. cmd.exe was excluded from the parent list because it is "the normal path for scheduled backup and ETL batch jobs" — and then powershell.exe and pwsh.exe were kept, when PowerShell is the modern normal path for exactly those jobs. Trace it: a nightly powershell.exe -File Backup.ps1 shells out to mysqldump.exe, Image matches, ParentImage matches, and the rule fires every night on every database server. The rule's own first false positive documents this. It kept the loud half and dropped the quiet one.

04 · Common false positives

Continuous database automation. APM and monitoring SQL health checks,
`excel.exe` → `bcp.exe` is not an edge case, it is the whole leg. Excel or
A DBA or developer launching a client from Explorer on a workstation where the
Vendor installers running sqlcmd.exe against a local instance during setup.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0242 and never executed against a log line. level: medium is a judgement, not a measured rate. To reach
tier_2: confirm 4688 or Sysmon EID 1 is collected on your database servers, inventory which of the fourteen clients actually exist in your estate (most will not), measure the PowerShell-parent volume for a week, and resolve the cmd.exe/powershell.exe inconsistency on the evidence rather than on reasoning.
tier_3: is the correlation MITRE actually described — client execution, then a dump file, then egress — which needs a correlation engine.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/1c8dda6a-ce4a-4877-98c2-8d7373cf33dd

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Database client launched by a script host or Office parent

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it