CmdID

CmdID / Files

DeviceEnroller.exe

API for MDM Enrollment file version info

Program on Windows 8 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real DeviceEnroller.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAPI for MDM Enrollment

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\DeviceEnroller.exe · signed by Microsoft Windows

5d5eedf15d4823c74840ec0209451b360c0ee4aaf9c1e7eddad27c49aeb76ce2

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\DeviceEnroller.exe · signed by Microsoft Windows

37791f628df0da25b5d3ccb45b150888a7c1b00635f91cb73c6b7184d8f888be

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\DeviceEnroller.exe · signed by Microsoft Windows

b9abaa487ab9f4f25ec61a98485766fb4d6ee97c4b0ecb202c23b9807feebc9b

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\DeviceEnroller.exe · signed by Microsoft Windows

cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DeviceEnroller.exe · signed by Microsoft Windows

d2e0947ff51cfb3cb1e3c7a1166981eb765cd74926785393487671d9a932cd04

10.0.18362.387 (WinBuild.160101.0800) · C:\WINDOWS\system32\DeviceEnroller.exe · signed by Microsoft Windows

e20e202e315bf904b35044cc607724d3cba508d063fe56fd3ce8e089792c03a1

10.0.17763.831 (WinBuild.160101.0800) · C:\Windows\system32\DeviceEnroller.exe · signed by Microsoft Windows

a3b38a659b9939703cb31a819288c711450ce1135c0143329801f8cabee0d288

10.0.14393.2515 (rs1_release_1.180830-1044) · C:\Windows\system32\DeviceEnroller.exe · signed by Microsoft Windows

420e680c4f681dca6273080e8b1290991a8889bbe7cbe7e47b88c830a4136108

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name DeviceEnroller.exe
mediumPotential DLL Sideloading Via DeviceEnroller.EXE@gott_cyber

Sigma names DeviceEnroller.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.