Windows Explorer Process Tree Break via Explorer Factory and /root Flags

title: Windows Explorer Process Tree Break via Explorer Factory and /root Flags
id: e5b8e692-80c7-47d6-ae6a-3cb2b9e1a271
status: test
description: This rule flags Windows process creation where the command line indicates explorer.exe being used to launch actions that break the normal process tree, including cases with an explorer factory invocation and /root flag usage. Attackers can use this to obscure the originating process and complicate attribution while still leveraging explorer.exe for execution. Telemetry required is Windows process creation events with full CommandLine content so the specific explorer.exe indicators can be matched.
references:
  - https://twitter.com/CyberRaiju/status/1273597319322058752
  - https://twitter.com/bohops/status/1276357235954909188?s=12
  - https://twitter.com/nas_bench/status/1535322450858233858
  - https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber, Huntrule Team
date: 2019-06-29
modified: 2025-10-31
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_factory:
    CommandLine|contains: /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}
  selection_root:
    CommandLine|contains: explorer.exe
    CommandLine|contains|windash: " /root,"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 949f1ffb-6e85-4f00-ae1e-c3c5b190d605
    type: derived