Ceplin Command Identifier

Identifier / Programs / Windows

explorer.exe

The Windows File Explorer. tldr-pages

LOLBAS Execute 13 Sigma rules name it 5 ATT&CK techniques 2 documented commands 25 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How explorer.exe is abused

documented by LOLBAS

Execute T1202 Indirect Command Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for explorer.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1202 Indirect Command Execution User privileges

Execute specified .exe with the parent process spawning from a new instance of explorer.exe

explorer.exe /root,"{PATH_ABSOLUTE:.exe}"
Identify

Trips 1 Sigma rule: mediumExplorer Process Tree Break by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber

Execute T1202 Indirect Command Execution User privileges

Execute notepad.exe with the parent process spawning from a new instance of explorer.exe

explorer.exe {PATH_ABSOLUTE:.exe}
Identify

Trips no Sigma process-creation rule.

1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for explorer.exe, by Jai Minton, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for explorer.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
highFile Explorer Folder Opened Using Explorer Folder Shortcut Via Shell@Kostastsale
highExplorer NOUACCHECK FlagFlorian Roth (Nextron Systems)
highRunDLL32 Spawning Explorerelhoim, CD_ROM_
lowPotential Proxy Execution Via Explorer.EXE From Shell ProcessFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious CustomShellHost ExecutionNasreddine Bencherchali (Nextron Systems)
highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highUncommon Userinit Child ProcessTom Ueltschi (@c_APT_ure), Tim Shelton
mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)
mediumArbitrary Binary Execution Using GUP UtilityNasreddine Bencherchali (Nextron Systems)
mediumSuspicious Userinit Child ProcessFlorian Roth (Nextron Systems), Samir Bousseaden (idea)
lowPotential Executable Run Itself As Sacrificial Processfrack113
T1135Network Share Discovery
T1202Indirect Command Execution
T1218System Binary Proxy Execution
T1218.011System Binary Proxy Execution: Rundll32
T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real explorer.exe?

file version info and known copies
Installed inC:\Windows\
C:\Windows\SysWOW64\
C:\Program Files (x86)\Spybot - Search & Destroy 2\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Explorer

25 known copies

10.0.22000.184 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\explorer.exe · signed by Microsoft Windows

3f4b611114c73a1e72dc0e42d1ff6999b6615dbf44c6efb11068d661660e17b6

10.0.22000.184 (WinBuild.160101.0800) · C:\WINDOWS\explorer.exe · signed by Microsoft Windows

4c1d9f1cb41545dd46430130fc3f0e15665bd1948942b0b85410305daa7aaa9c

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

04441a2e82a4bd350b448b135d52f0a981cf8d011279bed98afe48f500767b66

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

04dd313f7dbd4f392ada63d41db19eabb4b48c81a5f322ec6712f54f0dc70625

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

6620395d8dde0a46c329e16df15aa02eb63954c4ae0cb9dca44558d27e3c53d8

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

8f002979214bd06227820fd2996ae54904ebc6e44cc96c9e821a0795ef13ddab

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

0d3a89eaf1f8e56ade2307a6e78148793d406369963e4d7549f294ff692f0e88

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

17e476d38e5cbe18157ca79e8cd5b354c3d7c380f43b09a99556e281a0aa0f6b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

0f8286a1b3ff3be3eb650bae4dfff559cf6dc0afd4b90bcbef142718863568bf

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

6f26c1696c909282d86b1a4f2cd8b41d5f6f30c9dae5d316035f657d461c7e07

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

83a68acbc4625bb83988f7b54805924e02a0c69ebed981f7ad8a747a6091bc13

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

a10af678aaa578b7e716ede863d689e6e19d35a74742fe3546f823829f66c021

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

cbf28782a784112a777f37012bf170cbfaa2b2240a0cbb86a7038deb59b989a9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

e413d76c043d821933c23037d88b92036c2a80d52f3e858d8f14ccb67d9c2c44

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\explorer.exe · signed by Microsoft Windows

3f00013865e06a7d402e8565c6c553ed6099bc8e3d73c85e34292596c5a82d4d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\explorer.exe · signed by Microsoft Windows

d3e93d7c3f7bfbef756d46ea2d55290669ee7c26d82f5f7a6010c1a49a3aa2ec

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

0d7cb0b75cd61cdffe0e53910829ffa5c02c8759ebd27a49e2ef7a907a10e506

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\explorer.exe · signed by Microsoft Windows

b47c78a36a4db2fb653876f4d6bd3dd7726cd311c2b2f8204ce8ed21ebd700f2

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\SysWOW64\explorer.exe · signed by Microsoft Windows

c72b5dbc7b29a93ab28b6878a3d48ee43dc59b3a11948bab4b158b5f01e4d96a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\explorer.exe · signed by Microsoft Windows

f45557c0b57dec4c000d8cb7d7068c8a4dccf392de740501b1046994460d77ea

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\explorer.exe · signed by Microsoft Windows

888a2105f62ea40654a1b78de8e76ca1131c16e1d9fd28c75d7f4f3e1c0b8ff5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\explorer.exe · signed by Microsoft Windows

e004ccf9a53eb17365e694aa661aabc9a1fab00a62a179a4aeee079c265eb407

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\explorer.exe · signed by Microsoft Windows

03d1316407796b32c03f17f819cca5bede2b0504ecdb7ba3b845c1ed618ae934

6.3.9600.17031 (winblue_gdr.140221-1952) · C:\windows\SysWOW64\explorer.exe · signed by Microsoft Windows

5f692c3fb2827db7ac0d86b6f671b27b17176adfc0be14c11dfdb8f492a42c49

2.7.64.191 · C:\Program Files (x86)\Spybot - Search & Destroy 2\explorer.exe · signed by Safer-Networking Ltd.

6e6d555985fdda76c9926613c72a53e77e63b874532b3b631f30f475c32886ed

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Open Windows Explorer

explorerIdentify

Open Windows Explorer in the current directory

explorer .Identify

Open Windows Explorer in a specific directory

explorer path\to\directoryIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.

Other programs abused for Execute

acccheckconsole.exe · addinutil.exe · adplus.exe · advpack.dll · agentexecutor.exe · appcert.exe · applauncher.exe · appvlp.exe · at.exe · atbroker.exe · bash.exe · bginfo.exe · bitsadmin.exe · cdb.exe · certoc.exe · change.exe