CmdID

CmdID / Files

dsacls.exe

DS Control ACLs Program file version info

Program on Windows 2 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dsacls.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionDS Control ACLs Program

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dsacls.exe · signed by Microsoft Windows

1329d6c387f7c614c48cce6b1348f967f8f90d510d87d52d7a021a10cfffe880

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dsacls.exe · signed by Microsoft Windows

62a47479bd2c25bb97dda549578ea07e0ce31128155be47eb68fe4b04c48db9c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dsacls.exe
mediumPotential Password Spraying Attempt Using Dsacls.EXENasreddine Bencherchali (Nextron Systems)
mediumPotentially Over Permissive Permissions Granted Using Dsacls.EXENasreddine Bencherchali (Nextron Systems)