CmdID

CmdID / Files

dns.exe

Domain Name System (DNS) Server file version info

Program on Windows 2 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dns.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDomain Name System (DNS) Server

2 known copies

10.0.17763.719 (WinBuild.160101.0800) · C:\Windows\system32\dns.exe · signed by Microsoft Windows

2e80d7839970cf9d09b37ca444939049c5bebdcaa084f4be15dc4ff55f2057f6

6.3.9600.17327 (winblue_r3.140826-1500) · C:\windows\system32\dns.exe · not signed

0f841ce45a8be1072614cf851d4c45bbe230f695718c3077b6435a902e405dc2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dns.exe
criticalDNS RCE CVE-2020-1350Florian Roth (Nextron Systems)
highUnusual Child Process of dns.exeTim Rauch, Elastic (idea)

Sigma names dns.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.