CustomShellHost.exe

Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.

Use Can be used to evade defensive counter-measures

CustomShellHost.exe

Context

user

Native

Execute

MITRE

T1218

Detection

IOC: CustomShellHost.exe is unlikely to run on normal workstations

Sigma: github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml

Refs

twitter.com/YoSignals/status/1381353520088113154

docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher

lolbas-project.github.io/lolbas/Binaries/CustomShellHost/