CmdID

CmdID / Files

MsiDb.exe

Windows Installer Table Creator file version info

Program on Windows 2 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MsiDb.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\
C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\
Signed byMicrosoft Windows Kits Publisher
ProductWindows Installer, Microsoft Corporation
DescriptionWindows Installer Table Creator

2 known copies

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\arm\MsiDb.exe · signed by Microsoft Windows Kits Publisher

45f961231439ab96488e302504d8f926533deb86c671e04611bcb57aabf9377a

5.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\bin\10.0.19041.0\x86\MsiDb.exe · signed by Microsoft Corporation

a4df033d52a74020eb742a88138d312b0c3fb2770468fe8b6a9c5cfa5d2256b8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name MsiDb.exe
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)