SQLToolsPS.exe

~/Privilege Escalation/Windows/Binaries# cat SQLToolsPS.exe.md █

Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.

Paths:

C:\Program files (x86)\Microsoft SQL Server\130\Tools\Binn\sqlps.exe

Detection:

Execute

Run a SQL Server PowerShell mini-console without Module and ScriptBlock Logging.

SQLToolsPS.exe -noprofile -command Start-Process calc.exe