OceanLotus SQL Server RCE - Unusual Child Process from sqlservr.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Microsoft SQL Server (sqlservr.exe or mssql.exe) spawning common administrative or potentially malicious utilities (e.g., cmd.exe, powershell.exe, curl.exe, etc.). This behavior is often indicative of unauthorized code execution or lateral movement originating from the database engine, which should not typically initiate these processes.