Reverse Shell Outbound Connection Following Remote Mouse Port 1313 Exploitation

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•6

This rule detects a suspicious network connection on local port 1313 followed within 5 minutes by a PowerShell network connection to a non-standard port (not 80, 443, 8080, 8443). This behavior is characteristic of an initial exploit attempt targeting a service on port 1313, followed by a post-exploitation reverse shell.