Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut

Flags explorer.exe opened for My Computer via shell:mycomputerfolder when started by cmd or PowerShell.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: @Kostastsale (SigmaHQ), DRL 1.1
Published: 2022-12-22
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1135Network Share Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where cmd.exe, PowerShell (powershell.exe/pwsh.exe) spawns explorer.exe with a command line containing 'shell:mycomputerfolder', indicating the local “My Computer” folder is opened via a shell URI. Attackers can use this kind of built-in shell invocation to quickly reach discovery-related UI destinations or blend into normal user activity. Telemetry relies on Windows process creation events with parent process image, child process image, and the child process command line.

Reporting behind it

Related detections9 linkedT1135 — drag to rearrange

Malicious Network Share Discovery And/or Connection via Commandline (via process_creation)

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

NetScan Share Enumeration Write Access Check

Suspicious Network Share Enumeration via SharpShares

Suspicious SharpShares Network Share Enumeration Tool Execution

SharpHound Enumeration via SMB Named Pipes (via security)

Uncommon Network Share Discovery via Net View (via process_creation)

Windows Process Creation: Advanced Port Scanner PUA Execution via /portable /lng

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut

Pivot detection · T1135 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-explorer-launched-from-cmd-exe-or-powershell-with-shell-mycomputerfolder-c3d76afc

title: "Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut"
id: 10404a32-249d-46bc-ac4d-868b6efe7358
status: test
description: This rule identifies process creation where cmd.exe, PowerShell (powershell.exe/pwsh.exe) spawns explorer.exe with a command line containing 'shell:mycomputerfolder', indicating the local “My Computer” folder is opened via a shell URI. Attackers can use this kind of built-in shell invocation to quickly reach discovery-related UI destinations or blend into normal user activity. Telemetry relies on Windows process creation events with parent process image, child process image, and the child process command line.
author: "@Kostastsale, Huntrule Team"
references:
  - https://ss64.com/nt/shell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml
date: 2022-12-22
modified: 2024-08-23
tags:
  - attack.discovery
  - attack.t1135
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
    Image|endswith: \explorer.exe
    CommandLine|contains: shell:mycomputerfolder
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml
license: DRL-1.1
related:
  - id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL