Windows Explorer launched from cmd.exe or PowerShell with shell:MyComputerFolder

title: Windows Explorer launched from cmd.exe or PowerShell with shell:MyComputerFolder
id: 10404a32-249d-46bc-ac4d-868b6efe7358
status: test
description: This rule matches process creation where cmd.exe, powershell.exe, or pwsh.exe launches explorer.exe with a command line containing shell:mycomputerfolder. Attackers may use Windows shell folder shortcuts to quickly open system locations during discovery or staging. The detection relies on process creation telemetry, specifically parent image, child image, and the explorer command line string.
author: "@Kostastsale, Huntrule Team"
references:
  - https://ss64.com/nt/shell.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml
date: 2022-12-22
modified: 2024-08-23
tags:
  - attack.discovery
  - attack.t1135
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
    Image|endswith: \explorer.exe
    CommandLine|contains: shell:mycomputerfolder
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml
license: DRL-1.1
related:
  - id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4
    type: derived