Remote Mouse Socket.IO Keystroke Injection RCE (TCP 1313)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•3•0•3

Detects rapid Socket.IO 'key' event traffic directed at the unauthenticated Remote Mouse service (TCP 1313) followed by the spawning of command shell processes (cmd.exe, powershell.exe) on the same host. This pattern aligns with the Metasploit Remote Mouse RCE module, where an attacker simulates keystrokes to execute arbitrary commands.