T1218.012 — Verclsid

Tactic: Stealth · Platforms: Windows

Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell. Adversaries may abuse verclsid.exe to execute…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.012 System Binary Proxy Execution: Verclsid

title: "T1218.012 System Binary Proxy Execution: Verclsid"
id: df8eb6f3-06ca-47b1-b480-4da4eb060bf3
description: 'Detects verclsid.exe executed with the /S /C {CLSID} argument pattern used to proxy execution of COM/scriptlet payloads (T1218.012); the previous version also matched mavinject.exe, which belongs to a different technique (Process Injection via App-V, T1055.001), and has been removed. Tune using: AllowedCLSIDs, ParentProcessFilter, TimeWindow, ExternalIPRange.'
references:
  - https://attack.mitre.org/techniques/T1218/012
author: Shahrukh Khan
date: 2026-06-19
license: MIT
tags:
  - attack.stealth
  - attack.t1218.012

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith: '\verclsid.exe'
    CommandLine|contains|all:
      - '/S'
      - '/C'

  condition: selection

falsepositives:
  - Rare legitimate shell-extension verification triggered manually or by internal tooling; verclsid.exe is very rarely invoked with /S /C during normal Explorer operation.

level: high

Related sub-techniques

Explore