PowerShell reverse shell launched via cmd.exe after Remote Mouse keystroke injection

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•4

Detects cmd.exe spawning powershell.exe with command-line arguments indicative of a reverse shell, specifically leveraging encoded commands or TCP socket objects. This pattern is characteristic of attackers injecting malicious keystrokes via the Remote Mouse Socket.IO service.