High RiskWindowsLegitimateCommonly Abused
explorer.exeSYSTEM PROCESSexplorer.exe - Windows Shell Security Analysis
explorer.exe is the **Windows Shell** providing the desktop, taskbar, Start menu, and file browsing. It runs once per user session and is the parent of most user-launched applications. Attackers abuse explorer.exe for injection, spawning malicious processes, and masquerading.
Risk Summary
HIGH priority for SOC. explorer.exe is the user shell and parent of most user processes. Monitor for: multiple instances per session, unusual child processes, injection attempts, and explorer.exe outside Windows directory.
Overview
What is explorer.exe?
explorer.exe is the Windows Shell, providing:
- Desktop environment
- Taskbar and Start menu
- File Explorer windows
- Shell extensions
Security Significance
- Parent of User Processes: Most user apps are children of explorer.exe
- Injection Target: High-value target for process injection
- Always Running: Persistent during user session
- User Privileges: Runs with user token
Normal Behavior
Normal Behavior
Expected Process State
| Property | Expected Value |
|---|---|
| Path | C:\Windows\explorer.exe |
| Parent | userinit.exe (at logon), then self-parented |
| Instances | ONE per user session |
| User | Logged-in user account |
| Children | User applications |
Normal Child Processes
- User applications (browsers, Office, etc.)
- cmd.exe, powershell.exe (when user launches)
Common Locations
C:\Windows\explorer.exeSuspicious Indicators
Legitimate vs Suspicious
LEGITIMATE
Path: C:\Windows\explorer.exe
Instances: ONE per user
User: Logged-in user
Parent: userinit.exe initially
SUSPICIOUS
Path: C:\Windows\System32\explorer.exe (WRONG!)
C:\Users\...\explorer.exe
Instances: Multiple per session
User: SYSTEM (should be user)
Children: Unusual scripts, network tools
Abuse Techniques
Attack Techniques
Technique #1: Process Injection (T1055)
Injecting code into explorer.exe for:
- Keylogging
- Credential harvesting
- Persistence within user session
Technique #2: Masquerading
Malware named explorer.exe in wrong locations.
Technique #3: Shell Replacement
Winlogon\Shell registry modified to run malware instead of explorer.exe.
Detection Guidance
Detection Strategies
Priority #1: Path Verification
Process = "explorer.exe" AND
Path != "C:\Windows\explorer.exe"
→ ALERT: CRITICAL
Priority #2: Instance Count
User Session has >1 explorer.exe instance
→ ALERT: HIGH
Priority #3: Injection Detection
Monitor for:
- CreateRemoteThread into explorer.exe
- Unusual DLLs loaded
- Memory anomalies
Remediation Steps
Remediation
- Verify explorer.exe path
- Check for injected code
- Review Winlogon\Shell registry
- Kill and restart explorer if compromised
- Run malware scan
Investigation Checklist
Investigation Checklist
- Verify path is C:\Windows\explorer.exe
- Check for ONE instance per session
- Review Winlogon\Shell registry
- Check for process injection
- Examine loaded DLLs
- Review child process history
MITRE ATT&CK Techniques
Last verified: January 18, 2026