PowerShell reverse shell spawned via cmd.exe from injected keystrokes
Detects the execution of PowerShell with typical reverse shell command-line flags (-nop, -w hidden, -c) launched as a child process of cmd.exe. This pattern is commonly associated with remote code execution (RCE) scenarios, such as the exploitation of vulnerable applications that inject keystrokes or system commands via unauthenticated interfaces.
Microsoft Sentinel (KQL)
