Starting Applications thorugh explorer.exe

[Cyb3r-Monk]

Hi,

I just started using the tool and loved it!

Something that I see is that Office applications are launched through svchost.exe(DCOM service -> "svchost.exe -k DcomLaunch -p"). Also, Chrome is launched through chromedriver.exe I was wondering if it was possible to launch the applications through explorer.exe like a normal user.

[sei-dupdyke]

Hi, thanks for checking out the project.

Unfortunately, I don't know of a way to automate Office or the browser without using specific automation libraries to do so. For our uses, this is fine, since most of the activity is observed via the network or logs, where the chain that you show above is sort of obscured. I'm always looking for new ways to automate applications, however, so if you know of some method that removes the problem you highlight, please let me know.

[Cyb3r-Monk]

Thanks for the answer, Dustin!

I think it's only possible via process injection which is not feasible. If I come across a method, I'll let you know.
Btw, the screenshot is an excerpt from process creation logs.