{"id":"949f1ffb-6e85-4f00-ae1e-c3c5b190d605","title":"Explorer Process Tree Break","description":"Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,\nwhich is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from \"svchost\"\n","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber","status":"test","level":"medium","date":"2019-06-29","modified":"2025-10-31","tags":["attack.stealth","attack.t1036"],"technique_ids":["T1036"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/CyberRaiju/status/1273597319322058752","https://twitter.com/bohops/status/1276357235954909188?s=12","https://twitter.com/nas_bench/status/1535322450858233858","https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/"],"source_path":"rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml","source_sha256":"baa041bdb729da2775bcb7eef4755f1d0c3f72b1d493ec5c9ac7a7fdd6eea9d0","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Explorer Process Tree Break\nid: 949f1ffb-6e85-4f00-ae1e-c3c5b190d605\nstatus: test\ndescription: |\n  Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,\n  which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from \"svchost\"\nreferences:\n    - https://twitter.com/CyberRaiju/status/1273597319322058752\n    - https://twitter.com/bohops/status/1276357235954909188?s=12\n    - https://twitter.com/nas_bench/status/1535322450858233858\n    - https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber\ndate: 2019-06-29\nmodified: 2025-10-31\ntags:\n    - attack.stealth\n    - attack.t1036\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # Note: See CLSID_SeparateMultipleProcessExplorerHost in the registry for reference\n    selection_factory:\n        CommandLine|contains: '/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}' # This will catch, the new explorer spawning which indicates a process/tree break. But you won't be able to catch the executing process. For that you need historical data\n    selection_root:\n        CommandLine|contains: 'explorer.exe'\n        CommandLine|contains|windash: ' /root,'\n        # There exists almost infinite possibilities to spawn from explorer. The \"/root\" flag is just an example\n        # It's better to have the ability to look at the process tree and look for explorer processes with \"weird\" flags to be able to catch this technique.\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036","id":"T1036","name":"Masquerading","page":"techniques/enterprise/T1036/"}],"data_path":"data/detection-rules/949f1ffb-6e85-4f00-ae1e-c3c5b190d605.json","kind":"sigma"}