CmdID

CmdID / Files

baaupdate.exe

BitLocker Access Agent Update Utility file version info

Program on Windows 5 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real baaupdate.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionBitLocker Access Agent Update Utility

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\baaupdate.exe · signed by Microsoft Windows

d7d3fb7b1defe23559375be3c10dc5804367cf379d07888cda47f67ab527e0a0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\baaupdate.exe · signed by Microsoft Windows

9f2251424d855579c2e2ca78486ff4dd1df807e6f02fd5e513065225e44ad4c6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\baaupdate.exe · signed by Microsoft Windows

e41cc8865f998862c63420574823240850955cb2c41841654d105e388447471d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\baaupdate.exe · signed by Microsoft Windows

9cf66eaf1b13f74cf0770f1b7cdb557889dda61eab13ce5ed2b7c324a711f16a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\baaupdate.exe · not signed

c6efb6fd79e49a109753f7fc0ec1c696dc9e23d49e123b275c239a32b41d1384

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name baaupdate.exe
highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

Sigma names baaupdate.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.