cmd.exe Spawned by RemoteMouse/explorer.exe via Simulated Keystroke Injection

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•5

Detects the execution of the Windows command shell (cmd.exe) originating from either Windows Explorer or the RemoteMouse application. This activity often indicates an attempt to gain manual command-line interaction with the system, potentially through a malicious file execution, social engineering, or exploitation of the RemoteMouse application.