Web Server Spawning Database Client Utilities

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.