CustomShellHost.exe

A host process that is used by custom shells when using Windows in Kiosk mode.

Paths

  • C:\Windows\System32\CustomShellHost.exe

Commands

Execute

Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.

Use case: Can be used to evade defensive counter-measures

Privileges: User

CustomShellHost.exe

Detection

Resources