A host process that is used by custom shells when using Windows in Kiosk mode.
CustomShellHost.exe
Executes explorer.exe (with command-line argument /NoShellRegistrationCheck) if present in the current working folder.
Can be used to evade defensive counter-measures
C:\Windows\System32\CustomShellHost.exe
IOC: CustomShellHost.exe is unlikely to run on normal workstations, Sigma: https://github.com/SigmaHQ/sigma/blob/ff5102832031425f6eed011dd3a2e62653008c94/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml
John Carroll (@YoSignals)