CmdID

CmdID / Files

MsSense.exe

Windows Defender Advanced Threat Protection Service Executable file version info

Program on Windows 4 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MsSense.exe?

file version info and known copies
Installed inC:\Program Files\Windows Defender Advanced Threat Protection\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Defender Advanced Threat Protection Service Executable

4 known copies

10.8040.19041.1320 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe · signed by Microsoft Windows

e2baf6636b0ffb3a30d828f832ccb56b51aef63f9854acbc9cd211991e6ac3d6

10.7430.19041.423 (WinBuild.160101.0800) · C:\program files\Windows Defender Advanced Threat Protection\MsSense.exe · signed by Microsoft Windows

ccf0f9a4c6e37f6da991fdaf1cccc978770f9417a4509acfe878f46cc3a9be4c

10.7430.19041.423 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe · signed by Microsoft Windows

d87414d6a8321af3a9c0829de6ce1f8a84c844ada31067d4046b03f64367fcd2

10.7410.17763.1369 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe · signed by Microsoft Windows

af7115b5715618716e88fb62cc0548b2f5eaf751d0ba8320b99b285d956a4e87

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names MsSense.exe in 5 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.