Verclsid.exe is the Extension CLSID Verification Host. Windows uses it to verify each shell extension before Windows Explorer or the shell uses it. MITRE ATT&CK tracks abuse of it as T1218.012, Verclsid, in the Stealth tactic, on Windows.
How attackers use it
Adversaries can run verclsid.exe with a Class ID (CLSID), the unique identifier of a COM object. COM payloads executed this way may do many things, including loading COM scriptlets from remote servers, much like Regsvr32. Because the binary may be signed or native, it can bypass application control that does not consider it.
How to detect it
The MITRE strategy monitors process creation, CLSID arguments, and DLLs or scriptlet engines loaded into the process. If the CLSID points at remote scriptlet or HTA content, verclsid.exe will make outbound network connections, which is unusual for it.
Sysmon event ID 1 for the process, event ID 7 for module loads and event ID 3 for network connections cover that ground.
How to reduce the risk
- Block verclsid.exe with application control if it is not required.
- Change host firewall rules to prevent egress traffic from verclsid.exe.
- Remove it if it is not necessary in your environment.
Why it matters
Verclsid.exe runs in the background as part of normal shell activity, so its name will not stand out in a process list. What stands out is a run with a CLSID argument that you cannot explain, or any outbound connection from it. A host firewall rule that denies its egress costs almost nothing and removes the remote content path.
Quick check
What network behavior is a red flag for verclsid.exe?
Any outbound connection, since it can indicate the CLSID resolves to remote scriptlet or HTA content.
Sources
- MITRE ATT&CK, T1218.012: https://attack.mitre.org/techniques/T1218/012
