cmd.exe Spawned via Synthetic Keystroke Injection from RemoteMouse/Explorer

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•4

Detects the creation of cmd.exe with a parent process of RemoteMouse.exe or explorer.exe. This activity is indicative of synthetic keystroke injection, where malicious actors use applications like Remote Mouse to automate keyboard input—such as triggering the Start menu and typing commands—to achieve unauthorized code execution.