T1218.012: Verclsid
Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.[1]
Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.[2][3][4][5]
Analyst context for executives and security teams
Verclsid matters because it is a native Windows component that can be misused to run code through COM objects while looking like legitimate operating system activity. For leaders, the risk is not the binary itself; it is whether endpoint controls, allowlists, and SOC playbooks distinguish normal Windows shell extension verification from suspicious proxy execution.
Executive priority
Prioritize this as a Windows defense-validation issue under System Binary Proxy Execution. It can weaken confidence in application control and signed-binary trust models if verclsid.exe is broadly allowed without context. Security leaders should ask whether teams can produce evidence of process execution, command-line, COM-related activity, and outbound network attempts tied to verclsid.exe, and whether application control policies account for legitimate-but-abusable Windows binaries.
Technical view
This is a Windows sub-technique of T1218 System Binary Proxy Execution, aligned to stealth. ATT&CK does not provide an official detection section for this object, so SOC teams should validate against the related detection strategy DET0042 and local baselines. Focus on verclsid.exe executions that include unusual command-line patterns, unexpected parent processes, COM/CLSID references outside normal shell behavior, child process activity, or network connections consistent with remote COM scriptlet loading described in the official technique text. Use the Hancitor relationship as threat-context enrichment only, not as proof of current activity.
Likely telemetry
- Windows process creation events for verclsid.exe, including full command line, parent process, user, host, and integrity context
- Endpoint detection telemetry showing child processes, loaded modules, and script or COM-related execution context
- Windows registry or COM/CLSID-related telemetry where available
- Network egress telemetry from endpoints, especially connections initiated by or temporally related to verclsid.exe activity
- Application control, script blocking, or execution prevention logs showing allowed or blocked signed-binary proxy execution attempts
Detection direction
- Baseline normal verclsid.exe usage in the environment before alerting broadly, because it is a legitimate Windows binary associated with shell extension verification.
- Prioritize alerts where verclsid.exe is launched by unusual parents, includes COM/CLSID-oriented command-line parameters, appears in user-driven execution chains, or is followed by unexpected network or script-related behavior.
- Tune detections to avoid relying only on file signature or binary name; the technique is specifically relevant because signed or native binaries may be trusted by default.
- Correlate process, registry/COM, network, and application-control events rather than treating any single verclsid.exe execution as malicious.
- Review DET0042, the related detection strategy, for ATT&CK-aligned detection logic and adapt it to local endpoint and SIEM telemetry.
Mitigation priorities
- Review execution prevention controls such as application control and script blocking to ensure trusted Windows binaries are governed by behavior and context, not signature alone.
- Apply network filtering controls to limit unnecessary outbound access that could support remote payload retrieval or COM scriptlet loading paths described by the technique.
- Disable or remove unnecessary features or software only where operationally safe and justified; do not assume verclsid.exe can be removed without Windows functionality review.
- Document compensating controls and monitoring evidence for audit and compliance readiness, especially where application allowlisting exceptions are required for Windows system binaries.
- Test incident response playbooks for signed-binary proxy execution so analysts can quickly decide whether observed verclsid.exe activity is expected shell behavior or suspicious execution.
Analyst notes and limits
The supplied ATT&CK object identifies Verclsid as a Windows sub-technique under System Binary Proxy Execution and links it to mitigation guidance for network filtering, execution prevention, and disabling or removing unnecessary features. The relationship to Hancitor indicates known software usage in ATT&CK, but it should be used for enrichment rather than attribution in an investigation.
ATT&CK provides no official detection text for this technique in the supplied fields. Practical coverage depends on local Windows endpoint telemetry, command-line logging, COM/registry visibility, network logging, and the quality of application-control policy data. This summary does not establish current exploitation, customer exposure, or guaranteed detection.
Verclsid
Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.[1]
Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.[2][3][4][5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1218 | System Binary Proxy Execution | This object subtechnique of System Binary Proxy Execution. |
Groups, software, and campaigns
S0499: Hancitor
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 3.0 | Current bundle | 7cd693c4916d… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
WinOSBite verclsid.exe
verclsid-exe. (2019, December 17). verclsid.exe File Information - What is it & How to Block . Retrieved November 17, 2024.
Open source URL -
[2]
LOLBAS Verclsid
LOLBAS. (n.d.). Verclsid.exe. Retrieved August 10, 2020.
Open source URL -
[3]
Red Canary Verclsid.exe
Haag, M., Levan, K. (2017, April 6). Old Phishing Attacks Deploy a New Methodology: Verclsid.exe. Retrieved August 10, 2020.
Open source URL -
[4]
BOHOPS Abusing the COM Registry
BOHOPS. (2018, August 18). Abusing the COM Registry Structure (Part 2): Hijacking & Loading Techniques. Retrieved August 10, 2020.
Open source URL -
[5]
Nick Tyrer GitHub
Tyrer, N. (n.d.). Instructions. Retrieved August 10, 2020.
Open source URL -
[6]
mitre-attack T1218.012Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.