public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-28 15:58:24 +01:00
Code Issues Projects Releases Wiki Activity

Adding CustomShellHost.exe LOLBAS

Browse Source
This commit is contained in:
Wietze 2021-11-14 23:26:39 +00:00
parent 2031916b1a
commit 4860585fb7
No known key found for this signature in database
GPG Key ID: E17630129FF993CF
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
yml/OSBinaries/CustomShellHost.yml Normal file
View File

@ -0,0 +1,24 @@
---
Name: CustomShellHost.exe
Description: A host process that is used by custom shells when using Windows in Kiosk mode.
Author: 'Wietze Beukema'
Created: 2021-11-14
Commands:
- Command: CustomShellHost.exe
Description: Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.
Usecase: Can be used to evade defensive counter-measures
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\CustomShellHost.exe
Detection:
- IOC: CustomShellHost.exe is unlikely to run on normal workstations
Resources:
- Link: https://twitter.com/YoSignals/status/1381353520088113154
- Link: https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher
Acknowledgement:
- Person: John Carroll
Handle: '@YoSignals'
---