OceanLotus MSSQL RCE Initial Access - Suspicious sqlservr.exe Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects instances where the Microsoft SQL Server process (sqlservr.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative tools. This behavior is often indicative of remote code execution exploitation or post-exploitation activities following initial access on a database server.