Windows Ingress Tool Transfer Using Explorer

The analytic identifies instances where the Windows Explorer process (explorer.exe) is executed with a URL in its command line. This behavior is uncommon and suspicious, as adversaries may abuse explorer.exe to open URLs with the default browser to download and execute malicious payloads. This detection leverages process execution logs from EDR agents.