.. /CustomShellHost.exe
Star

A host process that is used by custom shells when using Windows in Kiosk mode.

Paths:

C:\Windows\System32\CustomShellHost.exe

Resources:

Acknowledgements:

John Carroll (@YoSignals)

Detection:

IOC: CustomShellHost.exe is unlikely to run on normal workstations
Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml

Execute

Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.
```
CustomShellHost.exe
```
Use case
Can be used to evade defensive counter-measures

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1218