verclsid.exe

Extension CLSID Verification Host file version info (xCyclopedia)

LOLBAS Execute 4 Sigma rules name it 2 ATT&CK techniques 1 documented command 12 known copies with hashes

How verclsid.exe is abused

documented by LOLBAS

Execute T1218.012 System Binary Proxy Execution: Verclsid

-s

-c

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for verclsid.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218.012 System Binary Proxy Execution: Verclsid User privileges

Used to verify a COM object before it is instantiated by Windows Explorer

verclsid.exe /S /C {CLSID}

Identify

Trips 1 Sigma rule: mediumVerclsid.exe Runs COM Object by Victor Sergeev, oscd.community

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for verclsid.exe, by @bohops, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for verclsid.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumVerclsid.exe Runs COM ObjectVictor Sergeev, oscd.community

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)

T1218System Binary Proxy Execution

T1218.012System Binary Proxy Execution: Verclsid

Is it the real verclsid.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionExtension CLSID Verification Host

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\verclsid.exe · signed by Microsoft Windows

cc6a47869fdba5ec67a20e0714b9b3162881462e36457c08b1b13b84683889e0

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\verclsid.exe · signed by Microsoft Windows

f499395681a7f49bd9b265b26c747109f5dc4c7ad5dcacf46bfac4540e447733

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\verclsid.exe · signed by Microsoft Windows

5f6fd0bc72eb2e71918241213e97dcd8fd0de2887a36be58b769e8c5a4ff8598

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\verclsid.exe · signed by Microsoft Windows

ac6e1f614cb902c0abe4297646e21c70590624b652a080bfbb8407b1ab52609d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\verclsid.exe · signed by Microsoft Windows

29e65e002297c3e4358354965e062c3a4eb421a7a72c3e8e5ad9982b770ae16e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\verclsid.exe · signed by Microsoft Windows

69da38c640682d46377fe8a6cb304da97893ab8d4989e5fa54edfd397a50c00b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\verclsid.exe · signed by Microsoft Windows

18c4e76431643aaf2113a5c4556cbe1d79cbc8113e4b0904a6205d73a8926045

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\verclsid.exe · signed by Microsoft Windows

50259658b30d267db199a0805e0986798dd799e18700fd198b894ce9e04db851

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\verclsid.exe · signed by Microsoft Windows

9c95ef6902dcd9b9c825a44142d3e7e6af3f265fc76da38726dee98b0c7e1127

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\verclsid.exe · signed by Microsoft Windows

a8e467fe242727bdd80dde990e9cbde008e2c0c50a404b4d4b6db76fdf7eafea

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\verclsid.exe · not signed

2294fed3a1625476ebc1afc219793fa9ed4ce56ae036926b79776cbac1ec2b30

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\verclsid.exe · not signed

c70e4ded6a371904dff62cc9ef4bd3c723c41dd615083da811940386d08d5538

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.