Suspicious Script Execution via Shell32 or Explorer Proxy
Detects the execution of scripts (.vbs, .js, .wsf, etc.) proxied through explorer.exe or rundll32.exe (via shell32.dll). Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Sigma
