CmdID

CmdID / Files

consent.exe

Consent UI for administrative applications file version info

Program on Windows 8 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real consent.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionConsent UI for administrative applications

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\consent.exe · signed by Microsoft Windows

aecfb06f61d2a6c697b469c9d3ee61972bbcedd30ded294828b88d6f95b86bb8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\consent.exe · signed by Microsoft Windows

15d0d3e45fd8312a00852a4f3e75f3e1faadd4b592c3e230e722cfefa3ddca2f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\consent.exe · signed by Microsoft Windows

56b2d516376328129132b815e22379ae8e7176825f059c9374a33cc844482e64

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\consent.exe · signed by Microsoft Windows

baf527d2f09ec003bb3e399347056a3ee2ad60f4e07e4010ce858ecce697ec75

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\consent.exe · signed by Microsoft Windows

19fd0010da92b654d1ca270247061a39ea13c0a58529fd8257a97e2ef7794911

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\consent.exe · signed by Microsoft Windows

8f112431143a22baaafb448eefd63bf90e7691c890ac69a296574fd07ba03ec6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\consent.exe · signed by Microsoft Windows

b2f1adf4123953eb808ffea652e0f0f894315e5205e25129c007c8ba10a2e79d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\consent.exe · signed by Microsoft Windows

86d8631c075400af09ecbfc531d64b187696d6aa277ad6d58e718e17ddcd4616

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name consent.exe
criticalExploiting CVE-2019-1388Florian Roth (Nextron Systems)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highUAC Bypass Using Consent and Comctl32 - ProcessChristian Burkard (Nextron Systems)
highUAC Bypass Using IEInstal - ProcessChristian Burkard (Nextron Systems)

Sigma names consent.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.