PowerShell Reverse Shell via Injected Keystrokes (Peyara Remote Mouse RCE)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

Detects instances where PowerShell is spawned by cmd.exe and includes command-line arguments indicative of a reverse shell, such as network socket creation, hidden execution, or encoded commands. This pattern often follows suspicious parent processes or activities such as keystroke injection.