libcef.dll
Chromium Embedded Framework (CEF) Dynamic Link Library file version info
Library on Windows 1 known copy with hashes 1 Sigma rule names it
Is it the real libcef.dll?
Installed in
C:\Program Files (x86)\Cisco Systems\Cisco Jabber\Signed byCisco Systems Inc.
ProductChromium Embedded Framework (CEF) Dynamic Link Library
DescriptionChromium Embedded Framework (CEF) Dynamic Link Library
1 known copy
76.1.9+g2cf916e+chromium-76.0.3809.87 · C:\Program Files (x86)\Cisco Systems\Cisco Jabber\libcef.dll · signed by Cisco Systems Inc.
73a215951e09e8204db18774d7551a96e5e29bd57dc76c21dfa60d8800ef4864From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names libcef.dll in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.