sqldumper.exe

SQL External minidumper file version info (xCyclopedia)

LOLBAS Dump 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands 1 known copy with hashes

How sqldumper.exe is abused

documented by LOLBAS

Dump T1003 OS Credential Dumping

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for sqldumper.exe.

2 documented commands

from LOLBAS, each read by the identifier

Dump T1003 OS Credential Dumping Administrator privileges

Dump process by PID and create a dump file (Appears to create a dump file called SQLDmprXXXX.mdmp).

sqldumper.exe 464 0 0x0110

Identify

Trips 1 Sigma rule: mediumDumping Process via Sqldumper.exe by Kirill Kiryanov, oscd.community

Dump T1003.001 OS Credential Dumping: LSASS Memory Administrator privileges

0x01100:40 flag will create a Mimikatz compatible dump file.

sqldumper.exe 540 0 0x01100:40

Identify

Trips 1 Sigma rule: mediumDumping Process via Sqldumper.exe by Kirill Kiryanov, oscd.community

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for sqldumper.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for sqldumper.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumDumping Process via Sqldumper.exeKirill Kiryanov, oscd.community

T1003OS Credential Dumping

T1003.001OS Credential Dumping: LSASS Memory

Is it the real sqldumper.exe?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\

Signed byMicrosoft Corporation

ProductMicrosoft SQL Server, Microsoft Corporation

DescriptionSQL External minidumper

1 known copy

2019.0150.1500.158 ((BI_Main).190506-1918) · C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe · signed by Microsoft Corporation

afd1b4a9869265d070d2575fff244bab18cf7a72153d932d5330f74ed7d3f2c7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.