CmdID

CmdID / Files

csrss.exe

Client Server Runtime Process file version info

Program on Windows 7 known copies with hashes 12 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real csrss.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionClient Server Runtime Process

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\csrss.exe · signed by Microsoft Windows

2e4f398084f26185b89e9d0cd89f1f0faf603a2f1c44ddca3adef321a15af621

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\csrss.exe · signed by Microsoft Windows

6f1c9b4c187669bc0371260d121caf48d65f829a9104c483befbd8fc0bed24f5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\csrss.exe · signed by Microsoft Windows

8ebf4096d28a78e8ab36e5084784acc90464eb4a74d972c942f147ea59e5134b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\csrss.exe · signed by Microsoft Windows

f2c7d894abe8ac0b4c2a597caa6b3efe7ad2bdb4226845798d954c5ab9c9bf15

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\csrss.exe · signed by Microsoft Windows

fb40ed0ffa6bc795923a941dab6b7d6b43583d0f152a6df4d8953d2c1a0cb417

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\csrss.exe · signed by Microsoft Windows

d896480bc8523fad3ae152c81a2b572022c3778a34a6d85e089d150a68e9165e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\csrss.exe · signed by Microsoft Windows Publisher

cb41e9d0e8107aa9337dbd1c56f22461131ad0952a2472b4477e2649d16ecb15

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name csrss.exe
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highSuspicious Process ParentsFlorian Roth (Nextron Systems)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highTerminal Service Process SpawnFlorian Roth (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)
lowWindows Processes Suspicious Parent Directoryvburov

Sigma names csrss.exe in 12 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.