Suspicious Explorer Process Tree Break (via process_creation)

title: Suspicious Explorer Process Tree Break (via process_creation)
id: f4bcf2e5-0feb-50af-b397-4c30a4ed5759
status: stable
description: This rule detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
references:
    - https://attack.mitre.org/techniques/T1036/
    - https://twitter.com/CyberRaiju/status/1273597319322058752
    - https://twitter.com/bohops/status/1276357235954909188?s=12
    - https://twitter.com/nas_bench/status/1535322450858233858
    - https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/
author: Huntrule Team
date: 2026-04-15
tags:
    - attack.stealth
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection_factory:
        CommandLine|contains: '/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}'
    selection_root:
        CommandLine|contains: 'explorer.exe'
        CommandLine|contains|windash: ' /root,'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium