Suspicious RazerInstaller Explorer Subprocess with System Integrity

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•23

This rule detects a suspicious `explorer.exe` subprocess spawned by `RazerInstaller.exe` with elevated privileges (System integrity level). While `explorer.exe` can be legitimately invoked by the installer to select a different installation folder, this specific behavior with System integrity can indicate an attempt to exploit a vulnerability in the RazerInstaller software for privilege escalation to LOCAL SYSTEM.