PowerShell reverse shell via injected keystrokes from cmd.exe

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•9

Detects the execution of PowerShell commands that utilize the .NET TCPClient class to initiate network connections. This behavior is frequently associated with reverse shell activity where a command shell (cmd.exe) spawns PowerShell to establish a remote connection to an attacker-controlled listener.