Windows

Sqldumper.exeSqldumper.exe

Platform
Windows
Abuse functions
2
Mapped techniques
2

Description

Sqldumper.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Dump. Mapped ATT&CK techniques (per LOLBAS / GTFOBins → MITRE crosswalk): T1003. Defenders should monitor execution of Sqldumper.exe under non-administrative or sudo contexts and alert when its arguments match the abuse-function signatures.

Abuse functions· 2

DumpT1003

Dump process using PID.

Dump LSASS.exe to Mimikatz compatible dump using PID.

MITRE ATT&CK techniques· 2

T1003T1003.001

Uses2

TypeTargetConfidenceTier
SubTechniqueLSASS Memoryt1003.001100%live
TechniqueOS Credential Dumpingt1003100%live

Abuses1

TypeTargetConfidenceTier
TechniqueOS Credential Dumpingt100385%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

LOLbin
Dump64.exe
LOLbin
Createdump.exe
LOLbin
DumpMinitool.exe
LOLbin
Procdump.exe
LOLbin
Sqlps.exe
LOLbin
SQLToolsPS.exe
Sourced from LOLBAS Project. Curated by Adam Lundqvist, SQUR.