Outbound PowerShell reverse shell following Remote Mouse port 1313 exploitation

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•1

Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.