TencShell - Explorer.exe Process Injection (T1055.001)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Identifies the implant injecting threads into explorer.exe to mask outbound network traffic, specifically when the initiating process is 'setup.exe'.