T1218.012sub-technique of T1218 System Binary Proxy Execution
Verclsid
Windowsnothing on this site yetT1218.012 on attack.mitre.org
Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell. Adversaries may abuse verclsid.exe to execute malicious payloads.
how MITRE says to see it
Detection Strategy for T1218.012 Verclsid Abuse
- Detects abuse of verclsid.exe to execute COM objects by monitoring process creation, CLSID arguments, DLLs or scriptlet engines loaded into memory, and If the CLSID points to remote SCT/HTA content, verclsid.exe makes outbound connections.
what reduces it
- M1037 Filter Network Traffic. Consider modifying host firewall rules to prevent egress traffic from verclsid.exe.
- M1038 Execution Prevention. Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program. Consider removing verclsid.exe if it is not necessary within a given environment.