CmdID

CmdID / Files

cacls.exe

Control ACLs Program file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command cacls

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real cacls.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionControl ACLs Program

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cacls.exe · signed by Microsoft Windows

279559ba82a45ea6071cb15ec776c32a8781e2c7dbf75f07849a952025a3f649

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cacls.exe · signed by Microsoft Windows

d8220a6f99e508db0a293867b150be2320d8057d02e56e254b6f44006e533523

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cacls.exe · signed by Microsoft Windows

092c1fe176ef37703a9bef4974ccf7ddd7a4d400fa37dcb04b721cce0657b03a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\cacls.exe · signed by Microsoft Windows

d6e40b4ed7c0bc8ac18b15d265ed2edab9efc260332ef0a98623f943be3a43fa

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\cacls.exe · signed by Microsoft Windows

7e32b9948fe3d9c99b34c2a8a6b85a160891c909b7358e2d621f1a40469ee6ea

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\cacls.exe · signed by Microsoft Windows

d134eb94124645e73c9bf7f97a834a6e6261d2890cc9bd11a75a34f4e16e812c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\cacls.exe · signed by Microsoft Windows

bc42118aaa1877eeff34b9a93dca8b94ed50109fb6436ae22e27d8e3b2bca78f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\cacls.exe · signed by Microsoft Windows

c81018f19c8c104e568d5168c7ca7011faa9c7ba7310510b303e54a7fafce84c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\cacls.exe · signed by Microsoft Windows

1e7c610f63ba1e22f8ce1350df98f0825a4a23328c15928be67ee6e8b58e0290

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\cacls.exe · signed by Microsoft Windows

aa37a9ca5bf8823635bce909c8d3bd97cd44080a20d1cd7e1c4dd4c85bac25d0

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\cacls.exe · not signed

4162faf99c4fd924ac71151ce344f38eecd424cefa1b6b9018a22b44a9532bac

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\cacls.exe · not signed

d7466a0e732a179041b43f76bfde6468e9fe75a3cc3595771d19f01cd7bf6902

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name cacls.exe
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)