explorer.exe

Overview

explorer.exe is the Windows Shell responsible for the graphical user interface, desktop, taskbar, file browsing, and much of the user’s interactive experience.

In most interactive sessions, it becomes the user’s long-lived parent process for applications launched through:

Expected Characteristics

Expected Location

Expected Parent

Typically:

winlogon.exe
    └── userinit.exe
            └── explorer.exe

In some environments, visibility may show userinit.exe directly as the parent.

Typical Profile

Why This Matters

explorer.exe persists for the entire interactive session and frequently launches applications, making it one of the busiest and most visible nodes in Windows process trees.

Attackers frequently abuse it for:

Abnormal command lines, suspicious child processes, or unusual DLL loading can all indicate malicious activity.

Relevant ATT&CK Techniques

Investigation Objective

Determine whether activity involving explorer.exe represents:

Normal Behaviour

Characteristics

Path

Parent

Typically:

userinit.exe

via:

winlogon.exe
    └── userinit.exe
            └── explorer.exe

Signature

Children

Common examples include:

Lifetime

Typical Activity

Expected Behavioural Characteristics

explorer.exe:

Abuse Patterns

Path or Signature Mismatch

Investigate immediately if:

A non-standard explorer.exe should be treated as highly suspicious.

Unexpected Parentage

Investigate explorer.exe launched by:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

rundll32.exe

or other LOLBins.

The standard parent should ultimately originate from userinit.exe.

Abnormal Command Lines

Investigate:

explorer.exe rarely requires complex command-line arguments.

Suspicious Child Processes

Examples include:

powershell.exe

cmd.exe

wscript.exe

cscript.exe

mshta.exe

rundll32.exe

Particularly when:

User-Writable Execution Paths

Investigate binaries launched from:

These frequently appear following phishing and user-execution scenarios.

Shell Extension Abuse

Investigate:

Shell extensions provide a common persistence mechanism because Explorer loads them automatically.

DLL Search Order Hijacking

Investigate:

Because explorer.exe loads many extensions and handlers, it can become a target for DLL hijacking attacks.

Explorer Restart Behaviour

Investigate:

Persistence mechanisms often reveal themselves during Explorer restarts.

Detection Opportunities

Parent-Child Relationship Analysis

Monitor for:

Understanding the surrounding user activity is essential when interpreting these events.

Command-Line Analytics

Investigate:

These events often provide stronger signals than process names alone.

User Context Correlation

Correlate:

Many malicious Explorer-related events become obvious once user actions are reviewed alongside process telemetry.

DLL and Shell Extension Monitoring

Monitor for:

Shell-extension persistence often leaves multiple artefacts available for detection.

Process Injection Detection

Investigate:

Process injection into explorer.exe remains a popular method of running within a trusted process.

Hunting Opportunities

Useful hunting pivots include:

The strongest findings usually emerge from combining user activity with process telemetry.

False Positives

Legitimate Explorer activity can vary significantly between users and environments.

Enterprise Shell Extensions

Examples include:

These frequently load DLLs into Explorer.

Enterprise Management Software

Examples include:

Such software may hook Explorer to enforce policy.

User-Initiated Scripting

Developers, administrators, and power users may legitimately launch:

through Explorer.

Context is critical.

Validation Questions

Check:

Determine whether execution aligns with a reasonable user action.

Estate-Wide Comparison

Legitimate enterprise tooling usually exhibits:

Rare behaviour deserves additional scrutiny.

Hardening Recommendations

Application Control

Consider:

Restrict execution of binaries from user-writable locations wherever possible.

Reduce User-Writable Execution

Focus on:

Reducing execution opportunities significantly limits user-context malware.

Shell Extension Governance

Maintain an inventory of:

Unknown extensions should be investigated promptly.

Monitor Explorer Persistence Mechanisms

Review:

These provide common persistence opportunities.

User Awareness and Execution Controls

Many Explorer-centred attacks rely on:

Reducing successful user execution reduces the effectiveness of many Explorer-based attack paths.

Defensive Validation

Regularly test:

Validation should be based on realistic user workflows rather than isolated demonstrations.

Triage Checklist

Identity and Integrity

Lineage and Behaviour

Shell Extension Review

Context and Scope

Escalation Considerations

Escalate when:

ATT&CK References

Windows Processes

Windows Shell

MITRE ATT&CK