CmdID / Files

firefox.exe

Firefox file version info

Program on Windows 4 known copies with hashes 29 Sigma rules name it

Is it the real firefox.exe?

file version info and known copies

Installed inC:\Program Files\Mozilla Firefox\

Signed byMozilla Corporation

ProductFirefox, Mozilla Corporation

DescriptionFirefox

4 known copies

94.0.1 · C:\Program Files\Mozilla Firefox\firefox.exe · signed by Mozilla Corporation

b984cdd9d3298c6ebdb6d3f4d80fea23fd20acb4c0edaf925365efaa0c1af289

81.0 · C:\Program Files\Mozilla Firefox\firefox.exe · signed by Mozilla Corporation

a6b9b90fe4467771f8af298d1accf28e94bb3de0912d4cfe45a4049c5a4e46f8

80.0 · C:\program files\Mozilla Firefox\firefox.exe · signed by Mozilla Corporation

2b2f9bc8882ef0f819c86bb14a69d894f7d59e033bc24f2053e991d92425d175

79.0 · C:\Program Files\Mozilla Firefox\firefox.exe · signed by Mozilla Corporation

47821033298c6d2b6eff436f7029e199a82a46f818b91d36121d5c25f4d2dbb7

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name firefox.exe

highInjected Browser Process Spawning Rundll32 - GuLoader Activity@kostastsale

highMstsc.EXE Execution From Uncommon ParentNasreddine Bencherchali (Nextron Systems)

highSuspicious FileFix Execution Pattern0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious PowerShell Parent ProcessTeymur Kheirkhabarov, Harish Segar

highTor Client/Browser Executionfrack113

mediumBrowser Started with Remote DebuggingpH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

mediumPotential Suspicious Browser Launch From Document Reader ProcessJoseph Kamau

lowHTML File Opened From Download FolderJoseph Kamau

Sigma names firefox.exe in 29 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.