Title:Suspicious CustomShellHost Execution Status:test Description:Detects the execution of CustomShellHost.exe where the child isn't located in 'C:\Windows\explorer.exe'. CustomShellHost is a known LOLBin that can be abused by attackers for defense evasion techniques.
References: -https://github.com/LOLBAS-Project/LOLBAS/pull/180 -https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/ Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-08-19 modified:2025-10-29 Tags:
-'attack.stealth'
-'attack.t1216'
Logsource:
category: process_creation
product: windows
Detection: selection: ParentImage|endswith:
'\CustomShellHost.exe' filter_main_explorer: Image:
'C:\Windows\explorer.exe' condition:selection and not 1 of filter_main_* Falsepositives:
-False positives are unlikely, investigate matches carefully. Level:high
