esent.dll
Extensible Storage Engine for Microsoft(R) Windows(R) file version info
Library on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real esent.dll?
C:\Windows\system32\C:\Windows\SysWOW64\2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\esent.dll · signed by Microsoft Windows
64503774b6d868418d3a02aec8e3da54b57f9d48722369ce12a0c2dbfb097fdc10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\esent.dll · signed by Microsoft Windows
f52a4473331e4c884fe4e123918f9335f702c1bae741a2b93f4f32d911ff520dFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names esent.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.