LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Explorer.exe

View source

Binary used for managing files and system components within Windows

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1202

Execute specified .exe with the parent process spawning from a new instance of explorer.exe

COMMAND
explorer.exe /root,"{PATH_ABSOLUTE:.exe}"
USE CASE
Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows XP, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1202

Execute notepad.exe with the parent process spawning from a new instance of explorer.exe

COMMAND
explorer.exe {PATH_ABSOLUTE:.exe}
USE CASE
Performs execution of specified file with explorer parent process breaking the process tree, can be used for defense evasion.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
02 / ON DISK

Known paths

C:\Windows\explorer.exe
C:\Windows\SysWOW64\explorer.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    Multiple instances of explorer.exe or explorer.exe using the /root command line is suspicious.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jai Minton@CyberRaiju
Jimmy@bohops