PowerShell Reverse Shell Launched via cmd.exe from Remote Mouse Keystroke Injection

Ibrahim Saud@tektrix

•updated Jul 2, 2026•7•0•16

Detects the execution of a hidden PowerShell process that initiates a TCP network connection using the .NET System.Net.Sockets.TCPClient class. This pattern is commonly used in fileless reverse shell implementations where a command-line process (like cmd.exe) spawns PowerShell to establish an outbound connection to an attacker-controlled remote host.