elastic-agent.exe
Agent manages other beats based on configuration provided. file version info
Program on Windows 1 known copy with hashes 1 Sigma rule names it
Is it the real elastic-agent.exe?
Installed in
C:\Program Files\Elastic\Agent\Signed byElasticsearch
ProductElastic-Agent, Elastic
DescriptionAgent manages other beats based on configuration provided.
1 known copy
7.15.1 · C:\Program Files\Elastic\Agent\elastic-agent.exe · signed by Elasticsearch
85666d9c2bb2d24cbe186899c0f6a4a350a8abf3f9967f27a905f71fd7a28de5From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names elastic-agent.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.