CmdID

CmdID / Files

logman.exe

Performance Log Utility file version info

Program on Windows 14 known copies with hashes 3 Sigma rules name it Command logman

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real logman.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPerformance Log Utility

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\logman.exe · signed by Microsoft Windows

8f0bd33907b705136560bc42502a2b697cc8cf4d14609b9a33fcd214d89ce46f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\logman.exe · signed by Microsoft Windows

b25c36f963d3050511cd164f14ad3e970fb7d04b88521ce8eba85dbcc788ac6f

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\logman.exe · signed by Microsoft Windows

2f5dd9ea0b39ff630ef53ea778c17bb4480980fc15d09291e7fcd97afda80d3d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\logman.exe · signed by Microsoft Windows

26e5ac855811075aa6acd25036a1273673315de6a601a463498d438f6dee3f88

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\logman.exe · signed by Microsoft Windows

9777ed488531b9e50b3b255743173a0490dbe93554974b3501a5f01f164e8454

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\logman.exe · signed by Microsoft Windows

cdaa7d2fd4328877fcab873cfa85b6b46b0a1afa6cc39017ced21dcfb139bba7

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\logman.exe · signed by Microsoft Windows

07e2b4c61b79d704f3992df77f5c5db3fcab868b3f6d66a735963bde158c2268

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\logman.exe · signed by Microsoft Windows

8d290236b47d598b09d7b8c2685609c63dc4bbd459fdd2e99957c074f698cea9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\logman.exe · signed by Microsoft Windows

2e40ac8fecf1ff562de9aafaea5192985ac3cc13be32b508771c885fd43673da

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\logman.exe · signed by Microsoft Windows

f1d7464233146e55dedf17ed942521ef2274e51963d6e4441279d100278a53e6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\logman.exe · signed by Microsoft Windows

58bf717313d23fff632b6e8d8bb58a96df2489c80f6fc2d4c8bfe499275fb483

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\logman.exe · signed by Microsoft Windows

f1e751d06bad5f77605cd422b8ec02d49ef137e88423356f4d16c25b35f3e35f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\logman.exe · not signed

b2f5da3aa6f748b3f03267cbb3918afc9e6e2b784f3b86abd457e9f2bba40c2a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\logman.exe · not signed

ef261231934b46b50c5045687e9ee65a8dde980de231f197d6d7edecbefb39b8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name logman.exe
highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
highSuspicious Windows Trace ETW Session Tamper Via Logman.EXEFlorian Roth (Nextron Systems)

Sigma names logman.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.