Socket.IO keyboard injection opens Start menu via Peyara Remote Mouse (TCP 1313)
Detects unauthenticated network connections to the Peyara Remote Mouse service on TCP port 1313. This service is known to allow remote control of the host, and such unauthenticated Socket.IO connections are often leveraged by attackers to inject synthetic keyboard events, such as triggering the Windows Start menu.
YARA-L
