.. /CustomShellHost.exe

Star

Paths:

• C:\Windows\System32\CustomShellHost.exe

Resources:

• https://twitter.com/YoSignals/status/1381353520088113154
• https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher

Acknowledgements:

• John Carroll (@YoSignals)

Detections:

• IOC: CustomShellHost.exe is unlikely to run on normal workstations
• Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml

Execute

1. Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.

   CustomShellHost.exe

   Use case

   Can be used to evade defensive counter-measures

   Privileges required

   User

   Operating systems

   Windows 10, Windows 11

   ATT&CK® technique

   T1218