Explorer Parent Shell Execution Detection

A’Keem Gurley@MFA_meex

•updated Feb 20, 2026•13•2•129

Detects common shell or script processes spawned by explorer.exe, which may indicate execution via the Windows Run dialog. This behavior aligns with ClickFix social engineering techniques and checks for suspicious command-line arguments tied to this pattern, often used to download or execute malicious code.