CmdID

CmdID / Files

LsaIso.exe

Credential Guard & Key Guard file version info

Program on Windows 7 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real LsaIso.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionCredential Guard & Key Guard

7 known copies

10.0.22000.258 (WinBuild.160101.0800) · C:\WINDOWS\system32\LsaIso.exe · signed by Microsoft Windows

17809f82c436dfe7bd312cd2bf320e5e9f8011dc64c50406ea48c3e64c898968

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\LsaIso.exe · signed by Microsoft Windows

9610808d82a12f4227df7ceab1dd5172b120e0fb19f660b394185d1c17f297cc

10.0.19041.1288 (WinBuild.160101.0800) · C:\Windows\system32\LsaIso.exe · signed by Microsoft Windows

e87672b39d716870df7c4426547d66d8155f284cdf8230c12b3bb31343a5c0e1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\LsaIso.exe · signed by Microsoft Windows

9e737a9ede8d3e623524b60fd2fcf000fef34aa1f274cb1da00735985b86ac30

10.0.18362.815 (WinBuild.160101.0800) · C:\WINDOWS\system32\LsaIso.exe · signed by Microsoft Windows

2e5fb6b74e671df2e1107fce403eb55af13ab08d799880396a60e191bd6e604c

10.0.17763.1192 (WinBuild.160101.0800) · C:\Windows\system32\LsaIso.exe · signed by Microsoft Windows

d66adb00f5eb0c5a08e7d844288d5acdbb38294830d5370d0b1395171382c87f

10.0.14393.3659 (rs1_release_1.200410-1813) · C:\Windows\system32\LsaIso.exe · signed by Microsoft Windows

06f7bd6fe8ece75b38e6cdbfe8d7ca9767fe1ad638a82671d6a4c855fd538bb6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name LsaIso.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
lowWindows Processes Suspicious Parent Directoryvburov

Sigma names LsaIso.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.