CmdID

CmdID / Files

psloglist64.exe

local and remote event log viewer file version info

Program on Windows 1 known copy with hashes 4 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real psloglist64.exe?

file version info and known copies
Original namepsloglist.exe in the file’s header: a renamed copy still carries it
Installed inC:\SysinternalsSuite\
Signed byMicrosoft Corporation
ProductSysinternals PsLogList, Sysinternals - www.sysinternals.com
Descriptionlocal and remote event log viewer

1 known copy

2.81 · C:\SysinternalsSuite\psloglist64.exe · signed by Microsoft Corporation

e2587dd0aa50d75b545e2100fb2bab0b0607ff7e87b264339c7fb695b8572342

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name psloglist64.exe
mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)
mediumSuspicious Use of PsLogListNasreddine Bencherchali (Nextron Systems)

Sigma names psloglist64.exe in 4 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.