CmdID

CmdID / Files

auditpol.exe

Audit Policy Program file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it Command auditpol

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real auditpol.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAudit Policy Program

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\auditpol.exe · signed by Microsoft Windows

a60d60a9b0427e962284683fa4091d0dc34c508fe74ef3d28c2db9bc5ff044bd

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\auditpol.exe · signed by Microsoft Windows

a86acb5e6ff088b72de41fd187d4caac9bdfa6624d3d28b1a4aed299580ac872

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\auditpol.exe · signed by Microsoft Windows

92274459d15dd69e20598f5ce54933635c2bd916ca2b0a039f96be782fac1ca6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\auditpol.exe · signed by Microsoft Windows

8362dded162b118d02528afeeb3af60ce0ecd60015ff9a65812f69619d3742a2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\auditpol.exe · signed by Microsoft Windows

ce7c5bbc024f803e35d1486585941f7ba6338543ccde606fc04138a22ac763bc

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\auditpol.exe · signed by Microsoft Windows

d1c6ec7f394b59d067dfd47a6a65978e4c2cc73437457a4b78209e5f516471cc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\auditpol.exe · signed by Microsoft Windows

643278719c680385d173588fdf2acd752a65e12180d416d07c1be79b49231d73

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\auditpol.exe · signed by Microsoft Windows

f2700c63442130158f3b685f99045198ea696497b23146391213574c17456dd5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\auditpol.exe · signed by Microsoft Windows

969306e33a469096efa20bee264fb37ac4da86899f2659007d6be0d1eb666b1c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\auditpol.exe · signed by Microsoft Windows

b01b1fad43094c5b336f8ed8818013db66d2a71141ee5c3602b951a7bf78b989

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\auditpol.exe · signed by Microsoft Windows

7f5b9dcc8f4825d19d9c7b6a82a149db624e39e0e2b8819317332fa7713c58c5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\auditpol.exe · signed by Microsoft Windows

91278da04f3a40da84cd151d3e69a4f39eef82bd7f7f3a238dd5e3c224caa33a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\auditpol.exe · not signed

08009f932d5a3ca2d856ab5a40a804b3fbb0c5083d0f2c8edcd17747a727a679

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\auditpol.exe · not signed

703ed2ae1b858f6a68ccd732524da6144c7c0db4734b88cc11f86572a7bce297

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name auditpol.exe
highAudit Policy Tampering Via AuditpolJanantha Marasinghe (https://github.com/blueteam0ps)