cmd.exe spawned via synthetic keystrokes after Remote Mouse port 1313 connection
Detects the execution of cmd.exe triggered by explorer.exe shortly after a network connection is established to the Peyara Remote Mouse service on TCP port 1313. This pattern is indicative of unauthorized remote command execution via synthetic keystroke injection, bypassing standard interactive session protections.
YARA-L
