MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1059Command and Scripting Interpreter

Execution

View on MITRE ATT&CK →

1 Query

Explorer.exe Spawning Suspicious Scripting Process

hightestingDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

let Parameters = dynamic(["http", "https", "Encoded", "EncodedCommand", "-e", "-eC", "-enc", "-w", "://"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "bash.exe", "cscript.exe", "mshta.exe", "msiexec.exe", "rundll32.exe"]);
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ (SuspiciousChildren)
| where ProcessCommandLine has_any (Parameters)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by Timestamp desc

Bert-JanP (adapted) · last tested 2025-03-01

Tuning notes

Legitimate software installations can trigger from explorer.exe context. Focus on encoded commands and URL parameters as stronger indicators.

+ Add another query for this technique →