Explorer Process Tree Break

Title: Explorer Process Tree Break
Status: test
Description:Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
References:
  -https://twitter.com/CyberRaiju/status/1273597319322058752
  -https://twitter.com/bohops/status/1276357235954909188?s=12
  -https://twitter.com/nas_bench/status/1535322450858233858
  -https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber
Date: 2019-06-29
modified:2025-10-31
Tags:

• -'attack.stealth'
• -'attack.t1036'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_factory:
    CommandLine|contains: '/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}'
  selection_root:
    CommandLine|contains: 'explorer.exe'
    CommandLine|contains|windash: ' /root,'
  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: medium