Potential Proxy Execution Via Explorer.EXE From Shell Process
This rule detects the creation of an 'explorer.exe' child process from common shell processes such as 'cmd.exe', 'powershell.exe', or 'pwsh.exe'. Attackers may use 'explorer.exe' as a proxy for execution to evade defense mechanisms. While this activity can be legitimate, it is often indicative of anomalous behavior and has been observed in use by threat actors like Muddy Waters.
Sigma
