Simulated Keystroke Injection: explorer.exe Spawns cmd.exe via Start Menu Search
This rule detects instances where the Windows Explorer process (explorer.exe) launches a command prompt (cmd.exe). While legitimate use may occur in certain scenarios, this pattern is often associated with malicious actors attempting to gain interactive shell access or execute commands via user-initiated actions or secondary exploitation vectors.
Cortex XDR
