Explorer Spawning Cmd with Start and Exit Commands
This rule detects a common worm behavior where 'explorer.exe' spawns 'cmd.exe' with both 'start' and 'exit' commands in the command line. This pattern is often used by worms like Phorpiex and Ippedo to launch a payload and then immediately close the shell, potentially to evade detection. The rule specifically looks for 'explorer.exe' as the parent process of 'cmd.exe' and requires both 'start' and 'exit' keywords in the 'cmd.exe' command line. It filters out legitimate uses involving 'msiexec', 'installutil', 'dotnet', 'npm', or 'node' in the command line.
Sigma
