Suspicious Explorer Child Process

  1[metadata]
  2creation_date = "2020/10/29"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or
 11executables from a trusted parent process.
 12"""
 13from = "now-9m"
 14index = [
 15    "logs-endpoint.events.process-*",
 16    "winlogbeat-*",
 17    "logs-windows.sysmon_operational-*",
 18    "endgame-*",
 19    "logs-m365_defender.event-*",
 20    "logs-sentinel_one_cloud_funnel.*",
 21]
 22language = "eql"
 23license = "Elastic License v2"
 24name = "Suspicious Explorer Child Process"
 25note = """## Triage and analysis
 26
 27> **Disclaimer**:
 28> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 29
 30### Investigating Suspicious Explorer Child Process
 31
 32Windows Explorer, a core component of the Windows OS, manages file and folder navigation. Adversaries exploit its trusted status to launch malicious scripts or executables, often using DCOM to start processes like PowerShell or cmd.exe. The detection rule identifies such anomalies by monitoring child processes of Explorer with specific characteristics, excluding known benign activities, to flag potential threats.
 33
 34### Possible investigation steps
 35
 36- Review the process details to confirm the suspicious child process was indeed started by explorer.exe with the specific parent arguments indicating DCOM usage, such as "-Embedding".
 37- Check the process command line arguments and execution context to identify any potentially malicious scripts or commands being executed by the child process.
 38- Investigate the parent process explorer.exe to determine if it was started by a legitimate user action or if there are signs of compromise, such as unusual user activity or recent phishing attempts.
 39- Correlate the event with other security logs or alerts from data sources like Microsoft Defender XDR or Sysmon to identify any related suspicious activities or patterns.
 40- Examine the network activity associated with the suspicious process to detect any unauthorized data exfiltration or communication with known malicious IP addresses.
 41- Assess the system for any additional indicators of compromise, such as unexpected changes in system files or registry keys, which might suggest a broader attack.
 42
 43### False positive analysis
 44
 45- Legitimate software installations or updates may trigger the rule when they use scripts or executables like PowerShell or cmd.exe. Users can create exceptions for known software update processes by identifying their specific command-line arguments or parent process details.
 46- System administrators often use scripts for maintenance tasks that might be flagged by this rule. To prevent false positives, administrators should document and exclude these routine scripts by specifying their unique process arguments or execution times.
 47- Some enterprise applications may use DCOM to launch processes for legitimate purposes. Users should identify these applications and exclude their specific process signatures or parent-child process relationships from the rule.
 48- Automated testing environments might execute scripts or commands that resemble suspicious activity. Users can mitigate false positives by excluding processes that are part of known testing frameworks or environments.
 49- Certain security tools or monitoring software may use similar techniques to gather system information. Users should verify and exclude these tools by confirming their process names and execution patterns.
 50
 51### Response and remediation
 52
 53- Isolate the affected system from the network to prevent further spread of the potential threat and to contain any malicious activity.
 54- Terminate the suspicious child process identified in the alert, such as cscript.exe, wscript.exe, powershell.exe, rundll32.exe, cmd.exe, mshta.exe, or regsvr32.exe, to stop any ongoing malicious actions.
 55- Conduct a thorough scan of the affected system using updated antivirus or endpoint detection and response (EDR) tools to identify and remove any additional malicious files or processes.
 56- Review and analyze the parent process explorer.exe and its command-line arguments to understand how the malicious process was initiated and to identify any potential persistence mechanisms.
 57- Escalate the incident to the security operations center (SOC) or incident response team for further investigation and to determine if the threat is part of a larger attack campaign.
 58- Implement additional monitoring and alerting for similar suspicious activities involving explorer.exe to enhance detection capabilities and prevent recurrence.
 59- Review and update endpoint security policies to restrict the execution of potentially malicious scripts or executables from explorer.exe, especially when initiated via DCOM."""
 60risk_score = 47
 61rule_id = "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b"
 62severity = "medium"
 63tags = [
 64    "Domain: Endpoint",
 65    "OS: Windows",
 66    "Use Case: Threat Detection",
 67    "Tactic: Initial Access",
 68    "Tactic: Defense Evasion",
 69    "Tactic: Execution",
 70    "Data Source: Elastic Endgame",
 71    "Data Source: Elastic Defend",
 72    "Data Source: Sysmon",
 73    "Data Source: Microsoft Defender XDR",
 74    "Data Source: SentinelOne",
 75    "Resources: Investigation Guide",
 76    "Noise: Medium",
 77    "Performance: Normal",
 78    "Profile: Recommended",
 79    "Threat: Living off the Land",
 80    "Rule Type: Event Correlation (EQL)",
 81    "Platform: Windows",
 82]
 83timestamp_override = "event.ingested"
 84type = "eql"
 85
 86query = '''
 87process where host.os.type == "windows" and event.type == "start" and
 88  (
 89   process.name : ("cscript.exe", "wscript.exe", "powershell.exe", "rundll32.exe", "cmd.exe", "mshta.exe", "regsvr32.exe") or
 90   ?process.pe.original_file_name in ("cscript.exe", "wscript.exe", "PowerShell.EXE", "RUNDLL32.EXE", "Cmd.Exe", "MSHTA.EXE", "REGSVR32.EXE")
 91  ) and
 92  /* Explorer started via DCOM */
 93  process.parent.name : "explorer.exe" and process.parent.args : "-Embedding" and
 94  not process.parent.args:
 95          (
 96            /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs   */
 97            "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}",
 98            "/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}"
 99          )
100'''
101
102setup = """## Setup
103
104This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
105
106Setup instructions: https://ela.st/install-elastic-defend
107
108### Additional data sources
109
110This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
111
112- [Microsoft Defender XDR](https://ela.st/m365-defender)
113- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
114- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
115"""
116
117
118[[rule.threat]]
119framework = "MITRE ATT&CK"
120
121[[rule.threat.technique]]
122id = "T1566"
123name = "Phishing"
124reference = "https://attack.mitre.org/techniques/T1566/"
125
126[[rule.threat.technique.subtechnique]]
127id = "T1566.001"
128name = "Spearphishing Attachment"
129reference = "https://attack.mitre.org/techniques/T1566/001/"
130
131[[rule.threat.technique.subtechnique]]
132id = "T1566.002"
133name = "Spearphishing Link"
134reference = "https://attack.mitre.org/techniques/T1566/002/"
135
136[rule.threat.tactic]
137id = "TA0001"
138name = "Initial Access"
139reference = "https://attack.mitre.org/tactics/TA0001/"
140
141[[rule.threat]]
142framework = "MITRE ATT&CK"
143
144[[rule.threat.technique]]
145id = "T1059"
146name = "Command and Scripting Interpreter"
147reference = "https://attack.mitre.org/techniques/T1059/"
148
149[[rule.threat.technique.subtechnique]]
150id = "T1059.001"
151name = "PowerShell"
152reference = "https://attack.mitre.org/techniques/T1059/001/"
153
154[[rule.threat.technique.subtechnique]]
155id = "T1059.003"
156name = "Windows Command Shell"
157reference = "https://attack.mitre.org/techniques/T1059/003/"
158
159[[rule.threat.technique.subtechnique]]
160id = "T1059.005"
161name = "Visual Basic"
162reference = "https://attack.mitre.org/techniques/T1059/005/"
163
164[[rule.threat.technique]]
165id = "T1559"
166name = "Inter-Process Communication"
167reference = "https://attack.mitre.org/techniques/T1559/"
168
169[[rule.threat.technique.subtechnique]]
170id = "T1559.001"
171name = "Component Object Model"
172reference = "https://attack.mitre.org/techniques/T1559/001/"
173
174[rule.threat.tactic]
175id = "TA0002"
176name = "Execution"
177reference = "https://attack.mitre.org/tactics/TA0002/"
178
179[[rule.threat]]
180framework = "MITRE ATT&CK"
181
182[[rule.threat.technique]]
183id = "T1218"
184name = "System Binary Proxy Execution"
185reference = "https://attack.mitre.org/techniques/T1218/"
186
187[[rule.threat.technique.subtechnique]]
188id = "T1218.005"
189name = "Mshta"
190reference = "https://attack.mitre.org/techniques/T1218/005/"
191
192[[rule.threat.technique.subtechnique]]
193id = "T1218.010"
194name = "Regsvr32"
195reference = "https://attack.mitre.org/techniques/T1218/010/"
196
197[[rule.threat.technique.subtechnique]]
198id = "T1218.011"
199name = "Rundll32"
200reference = "https://attack.mitre.org/techniques/T1218/011/"
201
202[rule.threat.tactic]
203id = "TA0005"
204name = "Defense Evasion"
205reference = "https://attack.mitre.org/tactics/TA0005/"