title: Explorer Root Flag Process Tree Break
id: 949f1ffb-6e85-4f00-ae1e-c3c5b190d605
description: Detects a command line process that uses explorer.exe /root, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer
status: experimental
references:
    - https://twitter.com/CyberRaiju/status/1273597319322058752
    - https://twitter.com/bohops/status/1276357235954909188?s=12
author: Florian Roth
date: 2019/06/29
modified: 2020/08/30
tags:
    - attack.defense_evasion
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all: 
            - 'explorer.exe'
            - ' /root,'
    condition: selection
falsepositives:
    - Unknown how many legitimate software products use that method
level: medium
