Peyara Remote Mouse RCE: explorer.exe spawns cmd.exe after port 1313 connection
This rule detects the execution of a Windows command shell (cmd.exe) spawned by Windows Explorer occurring within a 10-second window of network traffic identified as socket.io or websocket communication. This behavior often suggests a potential reverse shell or C2 connection where a command shell is invoked through or in conjunction with web-based communication channels.
Splunk (SPL)
