PPID Spoofing: PowerShell Spawned with Spoofed Explorer.exe Parent

Ibrahim Saud@tektrix

•updated Sep 19, 2026•2•0•6

Detects instances where powershell.exe appears to be launched by explorer.exe via parent process ID (PPID) spoofing. The rule identifies processes where the reported parent explorer.exe was created at or after the child powershell.exe, or within a suspiciously short timeframe, indicating that the parent PID association is likely fraudulent rather than a genuine explorer-initiated shell.