File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell

Title: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
Status: test
Description:Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.
References:
  -https://ss64.com/nt/shell.html
Author: @Kostastsale
Date: 2022-12-22
modified:2024-08-23
Tags:

• -'attack.discovery'
• -'attack.t1135'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    ParentImage|endswith:
      -'\cmd.exe'
      -'\powershell.exe'
      -'\pwsh.exe'

    Image|endswith: '\explorer.exe'
    CommandLine|contains: 'shell:mycomputerfolder'
  condition:selection
Falsepositives:
  -Unknown
Level: high