PowerShell reverse shell via cmd.exe spawned from Remote Mouse service
This rule monitors for instances where powershell.exe is spawned by cmd.exe, which in turn is a child process of the RemoteMouse application. It specifically flags command lines that involve network socket initialization or encoded commands, both of which are common indicators of malicious activity such as reverse shells or script-based attacks originating from a possibly compromised or malicious binary.
Microsoft Sentinel (KQL)
