PowerShell reverse shell spawned from cmd.exe via simulated keystroke input

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•6

Detects instances where cmd.exe spawns powershell.exe with command-line arguments indicative of malicious activity, such as network connection attempts via TCPClient or the use of Base64 encoded commands.