Configure-SMRemoting.exe
Configure-SMRemoting file version info
Program on Windows 3 known copies with hashes 1 Sigma rule names it
Is it the real Configure-SMRemoting.exe?
C:\Windows\system32\3 known copies
10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\Configure-SMRemoting.exe · signed by Microsoft Windows
c42b1cdba6020d3858ce47c6a0d279045a741f21263bb417742371d0c04ae79a10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\Configure-SMRemoting.exe · signed by Microsoft Windows
e26fe2ad8452293b4b1e957b21371693996941a4d3d2371e7e51a35892c594186.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\Configure-SMRemoting.exe · not signed
63be7455e335d9ae93f0b0c6c16355b85da0a25f83a85a84e81ced287bb4cff8From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names Configure-SMRemoting.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.