CmdID

CmdID / Files

MsMpEng.exe

Antimalware Service Executable file version info

Program on Windows 9 known copies with hashes 38 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MsMpEng.exe?

file version info and known copies
Installed inC:\Program Files\Windows Defender\
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0\
C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\
Signed byMicrosoft Windows Publisher
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionAntimalware Service Executable

9 known copies

4.18.2009.7 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2009.7-0\MsMpEng.exe · signed by Microsoft Windows Publisher

03d99b46fff022d7b8bdcdf52d25ab21b30f2346e3b388e22804ef5d6e1ae08f

4.18.2008.9 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2008.9-0\MsMpEng.exe · signed by Microsoft Windows Publisher

98f2679f37260cddbce40cefdc2a6f26450b1dd1271f2f43311d61a4a8229c96

4.18.2007.8 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2007.8-0\MsMpEng.exe · signed by Microsoft Windows Publisher

35b450f1946d573a37f711cfb4d6dc0385778c71f7ca2a70657dd68c456c40cc

4.18.2006.10 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2006.10-0\MsMpEng.exe · signed by Microsoft Windows Publisher

a601df49e5e6b2a5477a2516260fc01dbef186d7fd1c458c2bc57f7342e5bb9f

4.18.2005.5 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2005.5-0\MsMpEng.exe · signed by Microsoft Windows Publisher

aa23bbcaba315e1035fd397a512551c6573b1bad3b72665da4f7d6d6537012c8

4.18.2004.6 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2004.6-0\MsMpEng.exe · signed by Microsoft Windows Publisher

91917728e8019e77e7afac60d86174e0a61f1ce7ba0ea6078e648853be998800

4.18.2003.8 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\platform\4.18.2003.8-0\MsMpEng.exe · signed by Microsoft Windows Publisher

b595b1832b0a24d781ea501a881513381182138766b2385c96c0e356300b1b66

4.18.2001.10 (WinBuild.160101.0800) · C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2001.10-0\MsMpEng.exe · signed by Microsoft Windows Publisher

55cb6465f4038330e4705440cc5623d79805bbd1d33db0cff8b016eb2ac20d3f

4.18.1807.18075 (GitEnlistment(winpbld).180719-0853) · C:\Program Files\Windows Defender\MsMpEng.exe · signed by Microsoft Windows

b147cc9a14b92e224c7755d41e0453506f983e7874573f1df79f3ebf27bed090

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name MsMpEng.exe
criticalREvil Kaseya Incident Malware PatternsFlorian Roth (Nextron Systems)
highPotential PlugX ActivityFlorian Roth (Nextron Systems)
highSysinternals PsSuspend Suspicious ExecutionNasreddine Bencherchali (Nextron Systems)
highUncommon Svchost Command Line ParameterLiran Ravich
mediumUncommon Svchost Parent ProcessFlorian Roth (Nextron Systems)
lowWindows Processes Suspicious Parent Directoryvburov

Sigma names MsMpEng.exe in 38 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.