.. /Explorer.exe
Star

Binary used for managing files and system components within Windows


Paths:

Resources:
Acknowledgements:

Detection:

Execute

Execute calc.exe with the parent process spawning from a new instance of explorer.exe
explorer.exe /root,"C:\Windows\System32\calc.exe"
Usecase: Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
Privileges required: User
OS: Windows XP, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1202



Execute notepad.exe with the parent process spawning from a new instance of explorer.exe
explorer.exe C:\Windows\System32\notepad.exe
Usecase: Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1202