Running SQL and mapping the reader to objects

It looks ok for me so, just a couple of suggestions:

First: given it is a protected method and not a private, it can be called be derived classes which probably could not be in the same assembly (this is true only if the class is public) then, you shouldn´t use optional parameters, they force you to recompile all when you change them.

Instead, use an overloaded method as follow:

protected List<T> Query<T, TFactory>(string query) where TFactory : IFactory<T>
{
    return Query<T, TFactoty>(query, Enumerable.Empty<IDbDataParameter>());
}

protected List<T> Query<T, TFactory>(string query, IEnumerable<IDbDataParameter> parameters) 
    where TFactory : IFactory<T>
{

It also help you to remove the checking for nulls.

Second, if you return an IEnumerable, the callers will have less features. The rule is you you should require the most generic and return the most specific implementation so, if you have a list you could return a List<>, IList<> or a Collection. Then, callers have more options.

My attempts is this one:

protected List<T> Query<T, TFactory>(string query) where TFactory : IFactory<T>
{
    return Query<T, TFactoty>(query, Enumerable.Empty<IDbDataParameter>());
}

protected List<T> Query<T, TFactory>(string query, IEnumerable<IDbDataParameter> parameters) 
    where TFactory : IFactory<T>
{
    var collection = new List<T>();

    var factory = Activator.CreateInstance<TFactory>();
    var connection = (Db == null) ? Connection : Db.Connection; // this line looks rare for me

    using (var manager = new DbCommandManager(connection, sql))
    {
        foreach (var parameter in parameters)
            manager.AddParameter(parameter);

        using (var reader = manager.GetReader())
        {
            while (reader.Read())
                list.Add(factory.CreateTFromReader(reader));
        }
    }

    return list;
}

Update:

One more thing about optional parameters, when you call the Query method with one argument, you really are passing two: the query and a null in 'parameters'. You have never pass nulls (or at least you have to try) because if you pass nulls then, you need to check for null values.

One more thing about the protected modifier, privates methods can trust that their parameter won´t be null but protected methods cannot do it. This is because private members will be called by other methods in the same class but protected method can be called by other methods in other classes.