CustomShellHost.exe

Commands

1. ExecuteUser T1218

   Can be used to evade defensive counter-measures

   CustomShellHost.exe

   Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.

   os: Windows 10, Windows 11

   Execute: EXE

Detection

• IOCCustomShellHost.exe is unlikely to run on normal workstations
• Sigma https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml

Resources

• https://twitter.com/YoSignals/status/1381353520088113154
• https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher