CmdID

CmdID / Files

gpupdate.exe

Microsoft Group Policy Update Utility file version info

Program on Windows 16 known copies with hashes 2 Sigma rules name it Command gpupdate

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real gpupdate.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Group Policy Update Utility

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\gpupdate.exe · signed by Microsoft Windows

c9e2eb6e858e429e81d9b7247bb82dd62b7f2f205b3bba5a4c0ea053cc7cd412

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\gpupdate.exe · signed by Microsoft Windows

f1d24a99a27a4a485909ecad320e881c14c418a77d175bf666991d9709fef851

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpupdate.exe · signed by Microsoft Windows

9732b6c10d74c01d69be9d61f2056b4f30ff911045a14126d0c1352d02c276e3

10.0.19041.117 (WinBuild.160101.0800) · C:\Windows\system32\gpupdate.exe · signed by Microsoft Windows

14803cb04d08ad97c194a587273545627e729acc747669a0f6f069e0655e2438

10.0.19041.117 (WinBuild.160101.0800) · C:\Windows\system32\gpupdate.exe · signed by Microsoft Windows

b76ce2bba63bd2949fa6e36fba963379b9d682f7642cd3782d9818fcd30a3e00

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpupdate.exe · signed by Microsoft Windows

e6505e0e99a43130fb26e30d80cf2109543dd2f43ccc2d0de8023cad3d23fc7c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\gpupdate.exe · signed by Microsoft Windows

fb823e865dcc0bcbe540da48ac027405757d50d46d689f92d61ff7867025d488

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\gpupdate.exe · signed by Microsoft Windows

fe428f64b6920cbd542bf7097f009a576673888967cb5ae8803d310667ed428d

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpupdate.exe · signed by Microsoft Windows

4b95babe99abbefbcbd78e61d977c006354022923419db557579e87fe516b207

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\gpupdate.exe · signed by Microsoft Windows

0e8606ba02828d403e321e37f1568aa321a95d3bdbdb83b73583105b666d79ba

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\gpupdate.exe · signed by Microsoft Windows

6978a7d518e8b096070b854cb79176c6fcf18a7747f6d7efdc90e62aeb2d290c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\gpupdate.exe · signed by Microsoft Windows

91ffab6770bcf42f25b8674fe8c0df039d31b15d6a84616dfe839786f9088931

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\gpupdate.exe · signed by Microsoft Windows

6dab84ddd1e1db2fd7fa7dba8184a884085779e3ecfe219601c3db24b550ed56

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\gpupdate.exe · signed by Microsoft Windows

fdc5b3487347f4f29ce6e407bb0ce886da0a0d965384629fb4c0c6bbc6ecd4fc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\gpupdate.exe · not signed

3dd84330921869c8980fef735a32391f15c2fa0edca1a68e82eee48bdac1b227

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\gpupdate.exe · not signed

a2dbb68e62468b24185baf6e305a756f0fe3eb34f218417a1d579cf3d4a4bcab

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name gpupdate.exe
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

Sigma names gpupdate.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.