IOC: Multiple instances of explorer.exe or explorer.exe using the /root command line is suspicious.
Execute
Execute calc.exe with the parent process spawning from a new instance of explorer.exe
explorer.exe /root,"C:\Windows\System32\calc.exe"
Usecase: Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
Privileges required: User
OS: Windows XP, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1202
Execute notepad.exe with the parent process spawning from a new instance of explorer.exe
explorer.exe C:\Windows\System32\notepad.exe
Usecase: Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1202