System Binary Proxy Execution: Verclsid
- ID
- T1218.012
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1218 System Binary Proxy Execution
- Platforms
- Windows
- Data sources
- Process Creation, Module Load, Windows Registry Key Modification, Network Connection Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.[1]
Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.[2][3][4][5]
Detection
- DET0042 Detection Strategy for T1218.012 Verclsid Abuse
Data components: Process Creation, Module Load, Windows Registry Key Modification, Network Connection Creation
Mitigations (3)
- M1037 Filter Network Traffic
Consider modifying host firewall rules to prevent egress traffic from verclsid.exe.
- M1038 Execution Prevention
Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program
Consider removing verclsid.exe if it is not necessary within a given environment.