CustomShellHost.exe — LOLBAS

Execute

ExecutionWindows

Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.

Use Can be used to evade defensive counter-measures

CustomShellHost.exe

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: IOC: CustomShellHost.exe is unlikely to run on normal workstations
Sigma: github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml
Refs: twitter.com/YoSignals/status/1381353520088113154
docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher
lolbas-project.github.io/lolbas/Binaries/CustomShellHost/