OceanLotus MSSQL RCE - xp_cmdshell Execution via sqlservr.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•2

Detects the SQL Server process (sqlservr.exe) spawning suspicious child processes often associated with reconnaissance or command execution, such as command shell, PowerShell, or network diagnostic utilities. This is a common technique used by adversaries to execute commands or perform post-exploitation activities via database services.