Windows Suspicious CustomShellHost.exe Execution from Non-Explorer Parent

Alerts on CustomShellHost.exe executions where explorer.exe is not the expected parent process image.

FreeUnreviewedSigmahighv1

windows-suspicious-customshellhost-exe-execution-from-non-explorer-parent-84b14121

title: Windows Suspicious CustomShellHost.exe Execution from Non-Explorer Parent
id: 38e0e9e8-222f-48ba-b0d1-741c22e8a00a
status: test
description: This rule flags process creation events where CustomShellHost.exe is launched and its parent process path ends with \\CustomShellHost.exe, excluding cases where the relevant parent image is C:\Windows\explorer.exe. Attackers can abuse CustomShellHost.exe as a living-off-the-land binary to blend into normal execution flows and hinder defensive visibility. It relies on Windows process creation telemetry, specifically parent and image paths for the involved processes.
references:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/180
  - https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_customshellhost_susp_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-19
modified: 2025-10-29
tags:
  - attack.stealth
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \CustomShellHost.exe
  filter_main_explorer:
    Image: C:\Windows\explorer.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - False positives are unlikely, investigate matches carefully.
level: high
license: DRL-1.1
related:
  - id: 84b14121-9d14-416e-800b-f3b829c5a14d
    type: derived

What it detects

This rule flags process creation events where CustomShellHost.exe is launched and its parent process path ends with \\CustomShellHost.exe, excluding cases where the relevant parent image is C:\Windows\explorer.exe. Attackers can abuse CustomShellHost.exe as a living-off-the-land binary to blend into normal execution flows and hinder defensive visibility. It relies on Windows process creation telemetry, specifically parent and image paths for the involved processes.

Known false positives

False positives are unlikely, investigate matches carefully.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.