Windows Proxy Execution: explorer.exe Spawned by cmd.exe or PowerShell

Flags cmd.exe/powershell.exe launching explorer.exe, indicating possible proxy-based execution on Windows.

FreeUnreviewedSigmalowv1

windows-proxy-execution-explorer-exe-spawned-by-cmd-exe-or-powershell-9eb271b9

title: "Windows Proxy Execution: explorer.exe Spawned by cmd.exe or PowerShell"
id: efbbd8c5-84c9-41b2-aecb-2a8d9b3258e3
status: test
description: This rule flags process creation where a shell host (cmd.exe, powershell.exe, or pwsh.exe) launches a child process ending with explorer.exe. Attackers may proxy execution through explorer.exe to blend in with normal Windows activity while running their payload from a trusted-looking process. It relies on Windows process creation telemetry including parent process image paths and the child process command line. Alerting is intended for hunting, since this can also occur during legitimate user or script activity.
references:
  - https://twitter.com/CyberRaiju/status/1273597319322058752
  - https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_explorer_child_of_shell_process.yml
author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Huntrule Team
date: 2020-10-05
modified: 2024-06-21
tags:
  - attack.stealth
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
    Image|endswith: \explorer.exe
    CommandLine|contains: explorer.exe
  condition: selection
falsepositives:
  - Legitimate explorer.exe run from a shell host like "cmd.exe" or "powershell.exe"
level: low
license: DRL-1.1
related:
  - id: 9eb271b9-24ae-4cd4-9465-19cfc1047f3e
    type: derived

What it detects

This rule flags process creation where a shell host (cmd.exe, powershell.exe, or pwsh.exe) launches a child process ending with explorer.exe. Attackers may proxy execution through explorer.exe to blend in with normal Windows activity while running their payload from a trusted-looking process. It relies on Windows process creation telemetry including parent process image paths and the child process command line. Alerting is intended for hunting, since this can also occur during legitimate user or script activity.

Known false positives

Legitimate explorer.exe run from a shell host like "cmd.exe" or "powershell.exe"

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.