ofdeploy.exe
Office Deployment file version info
Program on Windows 4 known copies with hashes 1 Sigma rule names it
Is it the real ofdeploy.exe?
C:\Windows\system32\4 known copies
10.0 (WinBuild.160101.0800) · C:\Windows\system32\ofdeploy.exe · signed by Microsoft Windows
2e109b87aed87af5dbfd00ff1de4f577cfca7a652c74520bf363cf192b0fa69310.0 (WinBuild.160101.0800) · C:\WINDOWS\system32\ofdeploy.exe · signed by Microsoft Windows
3d05fb6f736051f281406eb4051d60e141f18c7041b48798dcc84d07bf3be39e10.0 (WinBuild.160101.0800) · C:\Windows\system32\ofdeploy.exe · signed by Microsoft Windows
c82577866c274eaf4bc5b4876f0140abe0e47a82dc49e9342416440497f0a04510.0 (WinBuild.160101.0800) · C:\WINDOWS\system32\ofdeploy.exe · signed by Microsoft Windows
e8bd90e28526bcf77032ff981d2f1112ae2e8866dc689b63057db716e5aa3843From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names ofdeploy.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.