public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-27 07:18:05 +01:00
Code Issues Projects Releases Wiki Activity

Merge pull request #180 from wietze/new/CustomShellHost

Browse Source 
Adding CustomShellHost.exe LOLBAS
This commit is contained in:
Conor Richard 2022-09-17 21:34:04 -04:00 committed by GitHub
commit 59808608e7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 23 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
yml/OSBinaries/CustomShellHost.yml Normal file
View File

@ -0,0 +1,23 @@
---
Name: CustomShellHost.exe
Description: A host process that is used by custom shells when using Windows in Kiosk mode.
Author: 'Wietze Beukema'
Created: 2021-11-14
Commands:
- Command: CustomShellHost.exe
Description: Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.
Usecase: Can be used to evade defensive counter-measures
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Windows\System32\CustomShellHost.exe
Detection:
- IOC: CustomShellHost.exe is unlikely to run on normal workstations
Resources:
- Link: https://twitter.com/YoSignals/status/1381353520088113154
- Link: https://docs.microsoft.com/en-us/windows/configuration/kiosk-shelllauncher
Acknowledgement:
- Person: John Carroll
Handle: '@YoSignals'