CmdID

CmdID / Files

dsquery.exe

Microsoft AD DS/LDS query command line utility file version info

Program on Windows 2 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real dsquery.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft AD DS/LDS query command line utility

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\dsquery.exe · signed by Microsoft Windows

1698a3cd79e3793e830c2190c46333d1a5de7626577e1f31ec10462d9d003b39

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\dsquery.exe · signed by Microsoft Windows

1c3d8a3f1bd401501a83edf5ccb51c1c74d74563d2716f2e8e0a35d16d277727

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name dsquery.exe
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
mediumDomain Trust Discovery Via DsqueryE.M. Anhaus, Tony Lambert, oscd.community, omkar72