Power Shell Spawned from Explorer via Win+R

Kaung Khant Ko@kaungkhantko

•updated Sep 23, 2026•2•0•3

This rule detects interactive or user-triggered execution of PowerShell carrying indicators of payload downloading, inline evaluation, or Base64 encoding. Because explorer.exe is the parent process, it typically signifies a payload delivered via email/web that a user opened directly such as an .lnk shortcut.