CmdID

CmdID / Files

LogonUI.exe

Windows Logon User Interface Host file version info

Program on Windows 6 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real LogonUI.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Logon User Interface Host

6 known copies

10.0.22000.120 (WinBuild.160101.0800) · C:\WINDOWS\system32\LogonUI.exe · signed by Microsoft Windows

4a224037f9832d0bbff2d61289f4f9030b72ebd42da90fb343ca94978bfd0459

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\LogonUI.exe · signed by Microsoft Windows

cf01e46c146699f6c0e3dd447043f59bc9438dbbcb9563af6c60ebc6d82727f2

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\LogonUI.exe · signed by Microsoft Windows

630067181fa5b2e7d9e7f50c6cecf3c3e60eea426a7ab0125810e3337e14bae0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\LogonUI.exe · signed by Microsoft Windows

9358ef8cb7fb08581d74274005263bd8fa2e6e0fc443930b25fd345cf6ce9071

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\LogonUI.exe · signed by Microsoft Windows

aa62d29803d52ec06cd27ed3124e034048f09606eb7342181913c9817c7b44c5

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\LogonUI.exe · not signed

997c0e69c490770815dd64189ad2f59f8309ad266981bfc5d70a728dd174d19c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name LogonUI.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names LogonUI.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.