CmdID

CmdID / Files

dsget.exe

Microsoft AD DS/LDS Get command line utility file version info

Program on Windows 2 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dsget.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft AD DS/LDS Get command line utility

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dsget.exe · signed by Microsoft Windows

1a9fb894dc7f4996aa08f708ffd384490924f5c01f36d5534e7f01442e9b3c4b

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dsget.exe · signed by Microsoft Windows

cd1ee46ae4b0c48617c99dc8b041a9586173b95560f1a1352f47bb9c9c7f90dc

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dsget.exe
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)