CmdID

CmdID / Files

dasHost.exe

Device Association Framework Provider Host file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dasHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDevice Association Framework Provider Host

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dasHost.exe · signed by Microsoft Windows

1fec19b4439bfdbbf42b74ba125d4bfa13c46fb78aa78dafd24b785844b4b445

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\dasHost.exe · signed by Microsoft Windows

88fd7e7e15d4c8b22c355ed56edd45734f05a55a5bdc18ec1917583194ecd981

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\dasHost.exe · signed by Microsoft Windows

f07e5ba7feeb9a18810d72e6a3a9b769c5a3d88064d71f92784fc8ea0f22491a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dasHost.exe · signed by Microsoft Windows

7f2f046ad83e7ac41f4a5f9319ab3564bac0c91f36c042d08be2b298bf3f8292

10.0.14393.2791 (rs1_release.190205-1511) · C:\Windows\system32\dasHost.exe · signed by Microsoft Windows

97543c2c341dacfcea21d5d3fb799e2112124ced951f33eb30bfc230d435f457

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\dasHost.exe · not signed

96c8f4b3e1f325dcd1ee5ae1fec78562d115099a731934aeadc3e49ef19a720d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dasHost.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names dasHost.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.