TencShell - Interactive Input Mocking (T1113)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•4

Identifies the active use of keyboard/mouse input simulation APIs from within the TencShell process memory, specifically when the initiating process is 'setup.exe'. This behavior is indicative of an attacker simulating user interaction.