CmdID

CmdID / Files

MRT.exe

Microsoft Windows Malicious Software Removal Tool file version info

Program on Windows 3 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MRT.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Malicious Software Removal Tool, Microsoft Corporation
DescriptionMicrosoft Windows Malicious Software Removal Tool

3 known copies

5.94.18626.1 · C:\WINDOWS\system32\MRT.exe · signed by Microsoft Windows

27cb2f21eb3f4ef1cc44e58cbecaba81adb91cbe6e39b86c3c6599f05db3c659

5.83.17439.1 · C:\Windows\system32\MRT.exe · signed by Microsoft Windows

a96f8928bec28857706e01fffd043dd88d863b23105937f8a83d763025254684

5.82.17046.2 · C:\Windows\system32\MRT.exe · signed by Microsoft Windows

0e648156e17aec12c15871c73966a59682b4c0562286eb764faf2ad256aa4c22

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name MRT.exe
highUncommon Svchost Command Line ParameterLiran Ravich
mediumUncommon Svchost Parent ProcessFlorian Roth (Nextron Systems)

Sigma names MRT.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.