CmdID

CmdID / Files

Discord.exe

Discord file version info

Program on Windows 1 known copy with hashes 9 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Discord.exe?

file version info and known copies
Installed inC:\Users\user\AppData\Local\Discord\app-1.0.9003\
Signed byDiscord Inc.
ProductDiscord, Discord Inc.
DescriptionDiscord

1 known copy

1.0.9003 · C:\Users\user\AppData\Local\Discord\app-1.0.9003\Discord.exe · signed by Discord Inc.

688709b3754c5446702062dff138369df87b5c21c865d40430628890b95f66db

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Discord.exe
mediumPotentially Suspicious Electron Application CommandLinefrack113, Nasreddine Bencherchali (Nextron Systems)
mediumProcess Proxy Execution Via Squirrel.EXENasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
mediumSuspicious Electron Application Child ProcessesNasreddine Bencherchali (Nextron Systems)
lowPotential Executable Run Itself As Sacrificial Processfrack113

Sigma names Discord.exe in 9 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.