CmdID

CmdID / Files

bcdedit.exe

Boot Configuration Data Editor file version info

Program on Windows 7 known copies with hashes 6 Sigma rules name it Command bcdedit

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real bcdedit.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionBoot Configuration Data Editor

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bcdedit.exe · signed by Microsoft Windows

f3438038c8c92acb3c4d15099f706c94d2881ecb1f2efa6d4edbf099277d1eca

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\bcdedit.exe · signed by Microsoft Windows

8de81171c19749e77dbf7317316eb8d0fe3bd1d2a52413e5d997e9248a325d37

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\bcdedit.exe · signed by Microsoft Windows

e458dc1dcfeab3b63636d8818261024081e64448f2dde7ff64277a6afea8bd7f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\bcdedit.exe · signed by Microsoft Windows

1ee229900c128119a122f9a7b3ff8ca2ab35154b314fc6b37cda6ce041e4277d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\bcdedit.exe · signed by Microsoft Windows

4d922e307aab064f072017593ca0d77f2599096696ef15c5e92137e915a51b8b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\bcdedit.exe · signed by Microsoft Windows

7202b952f1456dbe5c75b19bfe2b8bd37f40384007f1e51fd632ead10f1eeacc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\bcdedit.exe · not signed

85a43c95bc60213353be0960cc2947b8f458b6470c683fe18f35e0469c47d2d1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name bcdedit.exe
criticalRorschach Ransomware Execution ActivityX__Junior (Nextron Systems)
highBoot Configuration Tampering Via Bcdedit.EXEE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumPotential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE@neu5ron

Sigma names bcdedit.exe in 6 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.