.. /Explorer.exe
Star

Execute (EXE)

Binary used for managing files and system components within Windows

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Execute specified .exe with the parent process spawning from a new instance of explorer.exe

    explorer.exe /root,"C:\Windows\Temp\file.exe"
    Use case
    Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
    Privileges required
    User
    Operating systems
    Windows XP, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1202: Indirect Command Execution
    Tags
    Execute: EXE

  2. Execute notepad.exe with the parent process spawning from a new instance of explorer.exe

    explorer.exe C:\Windows\Temp\file.exe
    Use case
    Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1202: Indirect Command Execution
    Tags
    Execute: EXE