Explorer.exe Spawning PowerShell with Whitespace Obfuscation

Jorden Smith@Jorden

•updated Feb 10, 2026•0•30

Detects PowerShell spawned by explorer.exe with extensive whitespace padding followed by comment characters and fake document paths. This technique is used in social engineering attacks where victims are instructed to paste commands into File Explorer, with malicious code hidden by whitespace and a visible fake path comment (e.g., "# C:\Documents\policy.docx") to appear benign.