CmdID

CmdID / Files

mstsc.exe

Remote Desktop Connection file version info

Program on Windows 16 known copies with hashes 8 Sigma rules name it Command mstsc

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real mstsc.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionRemote Desktop Connection

16 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mstsc.exe · signed by Microsoft Windows

f7b09d5e38ed32001f198229f45c351e1b9821016bea0d6f32297bb7fc112d66

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mstsc.exe · signed by Microsoft Windows

82406d460fd405bdfef00e72769955b05ee89057c00c066296a092ff93348654

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mstsc.exe · signed by Microsoft Windows

08aab0687c052afcb0959dd9f5580745336c7b14e1acd40eba32e8b326f8bffc

10.0.19041.1266 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mstsc.exe · signed by Microsoft Windows

6d0f73a4fbf12fee6fe20a5b02cc23874a75977726e5b8605000321f3e686622

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mstsc.exe · signed by Microsoft Windows

1d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mstsc.exe · signed by Microsoft Windows

5ce2be81382fe4d759f0c4389972fbf508f5e9c8f06aafa7333244006f5f2cba

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mstsc.exe · signed by Microsoft Windows

a31eea63100d2ec1db5ae73a94120ed95e75421265679c4f72fade9b9156da90

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mstsc.exe · signed by Microsoft Windows

ce7d08d8b3a1a2434a366416b7ced545eaa296af3a3f76c4f0d6f0a94dda9eea

10.0.18362.752 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mstsc.exe · signed by Microsoft Windows

c162ad2306001b99cf2cbd7bb9e0ea274c890d6db2294cf6a517d66303c4b268

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mstsc.exe · signed by Microsoft Windows

d4967b245ce624c9d15e1563c82c84971ed4085aa9b2dc05b40c7e7f4be1caa3

10.0.17763.404 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mstsc.exe · signed by Microsoft Windows

280f1f1b21d6a8a6607e43b66ae528b1eb80e187e2ed3ff954a046c9eb6a23c2

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mstsc.exe · signed by Microsoft Windows

cf7882e388852eb0d62c4b5b40832947d18dafca4d2503bb30c4c8ae53a65647

10.0.14393.1358 (rs1_release.170602-2252) · C:\Windows\SysWOW64\mstsc.exe · signed by Microsoft Windows

65d7b7147b87d4e11586f0d657a77058366d734b235aaed14ef896e36c1bed89

10.0.14393.1358 (rs1_release.170602-2252) · C:\Windows\system32\mstsc.exe · signed by Microsoft Windows

ee45b5a00b98c0991ef802d496d3d3e0ad5a4c38d2f922d7f5f7a1d8efb113e5

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\mstsc.exe · not signed

df4d4192ed3a623f46ed7964d82c880e9ebc5a990ff8b149b4507b2deba95b7d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\mstsc.exe · not signed

fd08c03d220d524e871b5fe3ad2920726a5c97d32c4525de825220f3bbe4ee9e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name mstsc.exe
highMstsc.EXE Execution From Uncommon ParentNasreddine Bencherchali (Nextron Systems)
highSuspicious Mstsc.EXE Execution With Local RDP FileNasreddine Bencherchali (Nextron Systems)
mediumNew Remote Desktop Connection Initiated Via Mstsc.EXEfrack113
lowMstsc.EXE Execution With Local RDP FileNasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock

Sigma names mstsc.exe in 8 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.