Detect Shell Execute Hook Rootkits in Regedit

This article outlines how to identify and analyze legacy ShellExecuteHook persistence mechanisms using the Windows Registry Editor (Regedit). Threat actors and legacy rootkits historically leveraged ShellExecuteHooks to intercept process creation and maintain persistence within the operating system. By checking specific registry keys and tracing Class Identifiers (CLSIDs) back to their registered binaries, security analysts and system administrators can uncover unauthorized DLLs executing inside the Windows Explorer process.

Understanding ShellExecuteHooks

A ShellExecuteHook is an extension mechanism used by Windows Explorer to intercept and handle ShellExecute and ShellExecuteEx API calls. When a user or application executes a file, explorer.exe checks the registry for registered ShellExecuteHooks and calls the corresponding Dynamic Link Libraries (DLLs) before spawning the target process. While modern Windows versions have largely deprecated this behavior in favor of modern hooks, legacy malware and persistence techniques still target these registry locations.

Step 1: Navigate to ShellExecuteHook Registry Keys

To check for active hooks, launch regedit.exe with administrative privileges and navigate to the following registry paths:

• System-wide 64-bit:
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
• System-wide 32-bit (on 64-bit Windows):
  HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
• Current User:
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks

Step 2: Inspect the Values

Inside these keys, each entry represents a registered hook where the value name is a GUID (Globally Unique Identifier), also known as a CLSID.

• On standard, clean installations, the ShellExecuteHooks key may be empty or contain only default Microsoft values, such as {AEB71A22-329F-11d6-A109-00065B847369}.
• Any unexpected GUID present as a value name indicates a potential persistence hook that warrants investigation.

Step 3: Map the CLSID to the Target Binary

To determine what binary executes through the hook, copy the suspicious GUID (including the curly braces) and look up its registration:

1. Navigate to HKEY_CLASSES_ROOT\CLSID\{Suspicious-GUID}\InprocServer32 (or HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{Suspicious-GUID}\InprocServer32).
2. Examine the (Default) string value. This value contains the absolute file path of the DLL configured to load into explorer.exe.
3. Check the ThreadingModel value, which is typically set to Apartment for shell hooks.

Step 4: Analyze Indicators of Compromise

Once the file path is identified, verify the legitimacy of the binary:

• Location: Legitimate system shell extensions usually reside in C:\Windows\System32\. Binaries located in C:\Users\<User>\AppData\, C:\Temp\, or C:\ProgramData\ are strong indicators of malware.
• Digital Signatures: Check if the DLL is digitally signed by a trusted vendor using tools like Sysinternals Sigcheck or PowerShell (Get-AuthenticodeSignature).
• Hash Lookup: Calculate the SHA256 hash of the DLL and check it against threat intelligence platforms to determine if it is known malicious software.

Remediation

If a malicious hook is detected:

1. Delete the suspicious GUID entry located under the ShellExecuteHooks registry key.
2. Delete the associated CLSID key located under HKEY_CLASSES_ROOT\CLSID\{Suspicious-GUID}.
3. Terminate any rogue processes or restart explorer.exe.
4. Delete the malicious DLL file from disk or submit it to an isolated analysis environment.