SloppyRAT PowerShell Launch via Spoofed explorer.exe Parent PID

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•3

Detects the creation of a PowerShell process that identifies itself as being spawned by explorer.exe, while the process ID (PID) and parent process ID (PPID) relationship indicates inconsistency, often characteristic of the PSSpoof technique used by malware like SloppyRAT to evade detection by spoofing the process tree.