CmdID

CmdID / Files

iscsicli.exe

iSCSI Discovery tool file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real iscsicli.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptioniSCSI Discovery tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\iscsicli.exe · signed by Microsoft Windows

6438a99752207735d8d5b1a4e1b71e3c0b3447fcb0cabdde79ce62d5d02750b6

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\iscsicli.exe · signed by Microsoft Windows

ad3340592a28a1bce37789c6707cd2b561860507cb267584cc2495e525c2d8f6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\iscsicli.exe · signed by Microsoft Windows

436072addf870c0ed6b8e21c550cadfaa549264d35a18d4d0e3d3104846ba9e6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\iscsicli.exe · signed by Microsoft Windows

bdceca674699354dd54a9c3c2481ff9c1b947132c348de135cc7edeea452b524

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\iscsicli.exe · signed by Microsoft Windows

70130017cb36c60f4cc83cb5da6fafa2f2bde98f7e9f00e88850a5592e2b4a4b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\iscsicli.exe · signed by Microsoft Windows

9a38010de00fffdda33e00c90a264c3a560442d5d5769e0397406dd24aa5b88d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\iscsicli.exe · signed by Microsoft Windows

5a9de5ab7fe13ce4841c14238ceadd4fb86521fcd75c351f605bca66d3f99b8f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\iscsicli.exe · signed by Microsoft Windows

b62ed416f061fbf96185743de993d0ef17f552c91efa7d0c1001bbc845a03e97

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\iscsicli.exe · signed by Microsoft Windows

ce3228cc8f46d84800d99d569a1261d70fd56873c63f5e75b24b3fe02c53a9dd

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\iscsicli.exe · signed by Microsoft Windows

f7ce61ce0d42c55cf5bc86d304e08d222fe49544754b08a0a17df0660ed13699

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\iscsicli.exe · not signed

351800b0e186fdf3cf9a4894a37dac26515f85d4ec980379deb3ca72df3fe092

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\iscsicli.exe · not signed

c2febb3b78b93d71c61ee58d307d4b86b64718ab6690a69b6a8705c0def53d0b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names iscsicli.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.