cmd.exe spawned via Peyara Remote Mouse keystroke injection over TCP/1313
Detects the execution of cmd.exe originating from the Remote Mouse or Peyara service process, correlating with an immediately preceding unauthenticated network connection on TCP port 1313. This behavior is indicative of exploitation of a remote service vulnerability, often associated with the Peyara Remote Mouse remote code execution exploit.
Microsoft Sentinel (KQL)
