Suspicious Command Shell Activity from Explorer or Task Manager

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•1

This rule detects suspicious activity where 'cmd.exe' or 'powershell.exe' are launched from 'explorer.exe' or 'taskmgr.exe' with a high frequency (3 or more times within an hour) by the same user on the same computer. This pattern can indicate an attacker attempting to gain command-line access or execute scripts after initial access, potentially bypassing direct execution from malicious processes.