Explorer launches a process from a non-system drive letter

Siemphony@siemphonymediumT1091unverified

AN0841 chains a drive-mount event (System 1006), a file write to the new volume (Sysmon 11) and execution from it (Sysmon 1) within a `FileExecutionWindow`; Sigma has no cross-event timer, so this rule keeps the execution leg alone and adds the one correlate a single process_creation event can carry — the parent. `ParentImage` ending in explorer.exe is the double-click path: a user opened the removable volume in a folder window and launched something from it, which is the social-engineering half of this technique rather than a true Autorun/AutoPlay launch, since that path spawns from a different parent and is not covered here. `Image` starting with a letter from D: through H: is MITRE's `DriveLetterMatch` knob, populated with the drive letters Windows assigns to removable media on a machine whose C: is the system volume; it is a structural stand-in for "removable" and cannot tell a USB stick from a second internal disk, an optical drive or a mapped volume that happens to land in that range — `FileEntropy`, which would help separate a packed payload from a normal file, has no Sigma equivalent either. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0301, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (InitiatingProcessFolderPath endswith "\\explorer.exe" and (FolderPath startswith "D:\\" or FolderPath startswith "E:\\" or FolderPath startswith "F:\\" or FolderPath startswith "G:\\" or FolderPath startswith "H:\\"))

Splunk · SPL

Run this as a search.

index=* (ParentImage="*\\explorer.exe" AND (Image="D:\\*" OR Image="E:\\*" OR Image="F:\\*" OR Image="G:\\*" OR Image="H:\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.parent.executable) LIKE "*\\\\explorer.exe" AND (TO_LOWER(process.executable) LIKE "d:\\\\*" OR TO_LOWER(process.executable) LIKE "e:\\\\*" OR TO_LOWER(process.executable) LIKE "f:\\\\*" OR TO_LOWER(process.executable) LIKE "g:\\\\*" OR TO_LOWER(process.executable) LIKE "h:\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\explorer\.exe$</field>    <field name="Image" type="pcre2">(?i)(^D:\\|^E:\\|^F:\\|^G:\\|^H:\\)</field>    <description>Explorer launches a process from a non-system drive letter</description>    <mitre>      <id>T1091</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 792753da-7723-4704-8b5f-1e8c7caaacf5

ATT&CKT1091

T1091Replication Through Removable Media

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

A process launched by Explorer whose image path starts on a drive letter from D: through H: — the double-click path: a user opens a removable volume in a folder window and runs something from it. AN0841 actually chains three events: the drive mount (System 1006), a file write to the new volume (Sysmon 11), and execution from it (Sysmon 1) inside a FileExecutionWindow. Sigma has no cross-event join or timer, so this rule keeps only the execution leg and adds the one correlate a single process_creation event can carry — the parent. True Autorun/AutoPlay execution spawns from a different parent than explorer.exe and is explicitly not covered here; neither is the mount-then-write correlation that would confirm the file actually arrived on the drive during this session rather than sitting there already.

02 · Telemetry you need

Sysmon EventID 1 (process_creation), with ParentImage and Image populated — the default Sysmon config captures both. Sysmon's own path allowlisting doesn't apply to process creation the way it does to registry or file monitoring, so no separate audit prerequisite gates this one; the gap is entirely in what the rule chooses to correlate, not in what's collected.

03 · How the logic works

Both selections must hold: the launching process is Explorer, and the target binary's path starts on one of five letters. That letter range is MITRE's DriveLetterMatch knob, populated here with the default block Windows tends to assign removable media on a machine whose C: is the system volume — it is a structural stand-in for "removable," not a real device-class check, and FileEntropy (which would help separate a packed payload from an ordinary one) has no Sigma equivalent at all. The reviewer confirmed the endswith convention on ParentImage correctly excludes lookalikes like a hypothetical iexplorer.exe, and that this rule is a distinct observable from the corpus's other drive-letter rules (T1025, T1200), not a duplicate.

04 · Common false positives

Portable applications run directly from a USB stick — routine for field
A D: or later letter that is actually a second internal disk, a mounted
Offline software or driver distribution on USB for air-gapped networks,
Network drives mapped with net use to a letter in this range, launched
The reviewer flagged a gap here: subst-mapped drives (a local re-parse

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0301 and never executed against logs. level: medium is the author's judgement; the reviewer rated the rule usable-as-scaffold with no dispute against the level.
tier_2: means running it over history to confirm the actual noise floor from portable-app and imaging traffic on your fleet.
tier_3: means adding the System 1006 and Sysmon 11 legs to correlate mount, write and execution inside MITRE's FileExecutionWindow, and covering the cmd.exe/.lnk evasion path the reviewer identified.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Site-specific DriveLetterMatch: replace the default D–H range with
Suppress by parent-of-parent or by a known-good software distribution
The reviewer's evasion note matters more than any suppression: launching

Declared by the author

Portable applications run directly from a USB stick, which is routine for field technicians, contractors and kiosk-style workstations and produces exactly this parent-child shape without anything malicious involved.
Machines where D: or a later letter is a second internal or virtual disk rather than removable media — a data partition, a mounted VHD/VHDX, or a DVD/ISO drive — none of which this selector can distinguish from a USB device; MITRE's DriveLetterMatch knob is where a site's own layout replaces the default range.
Offline software or driver distribution on USB, mentioned directly in the technique's own description for air-gapped networks, where IT deliberately copies an installer to media and a user double-clicks it from Explorer.
Network drives mapped with net use to a letter in this range, which a user can launch content from by double-clicking in Explorer identically to a physically removable volume.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1091, evaluated against their process_creation events.

Share this rule

/u/siemphony/792753da-7723-4704-8b5f-1e8c7caaacf5

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Explorer launches a process from a non-system drive letter

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it