OceanLotus MSSQL RCE - sqlservr.exe spawning shells or curl for SPECTRALVIPER staging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where the SQL Server process (sqlservr.exe) spawns suspicious child processes, which is a common indicator of Remote Code Execution (RCE) exploitation. This includes the execution of command shells (cmd, powershell), web clients (curl, wget), and other utilities commonly used for post-exploitation staging and payload delivery, such as those associated with potential xp_cmdshell abuse.