CmdID

CmdID / Files

appcmd.exe

Application Server Command Line Admin Tool file version info

Program on Windows 6 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real appcmd.exe?

file version info and known copies
Installed inC:\Windows\system32\inetsrv\
C:\Windows\SysWOW64\inetsrv\
Signed byMicrosoft Windows
ProductInternet Information Services, Microsoft Corporation
DescriptionApplication Server Command Line Admin Tool

6 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\inetsrv\appcmd.exe · signed by Microsoft Windows

429bc84babe1387abf59eefb0b225a1f5317fdb1d3f29995dbd5604e78b3ac33

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\inetsrv\appcmd.exe · signed by Microsoft Windows

ccd7e7635bd261815dfac9ab6edb52a9789c3275db09ea86a964f0e395bdba4a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\inetsrv\appcmd.exe · signed by Microsoft Windows

2dab5d0ea03b1f358343b9ffb5b68ecbfc3326e164f46122a1553a980bc3a520

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\inetsrv\appcmd.exe · signed by Microsoft Windows

60227991c5461fb4fa693ed8b70c85214d6a10ed753a35cdbba9056a5e1d6a3f

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\inetsrv\appcmd.exe · not signed

9ad840cbb21e4ac99f0d3c5000f01d94fb94cfeef1d3e81cc9f50a7f23518a50

8.5.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\inetsrv\appcmd.exe · not signed

e1997829e5a0d5ec1327b68f194b803c5ea30ad9b42ba42d54387e16d3ae53f5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name appcmd.exe
highDisable Windows IIS HTTP Loggingfrack113
highMicrosoft IIS Service Account Password DumpedTim Rauch, Janantha Marasinghe, Elastic (original idea)
highSuspicious IIS Module RegistrationFlorian Roth (Nextron Systems), Microsoft (idea)
mediumIIS Native-Code Module Command Line InstallationFlorian Roth (Nextron Systems)
mediumSuspicious IIS URL GlobalRules Rewrite Via AppCmdNasreddine Bencherchali (Nextron Systems)