CmdID

CmdID / Files

sdclt.exe

Microsoft Windows Backup file version info

Program on Windows 7 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sdclt.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Windows Backup

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdclt.exe · signed by Microsoft Windows

2496646830672fd5c1379d8108612aef22284eacae4d93b586c6eb6f96f29e91

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdclt.exe · signed by Microsoft Windows

1558a9dc9d6749dda20a1846cd26887486af40c569c9a1deb911c43a78a61978

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdclt.exe · signed by Microsoft Windows

58dd58a15da129e44ca5116e2da71a913abd08c7de7f3d2f3a843f867108f9a9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdclt.exe · signed by Microsoft Windows

e6a113c31abcae8845d15e3f3637dd2317dd0268a73bf2688ff6f020c7fe85c9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdclt.exe · signed by Microsoft Windows

efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdclt.exe · signed by Microsoft Windows

f6be29f4cffabb00b95b7de577e1138a34d1fbbbc4ce122536792276273e75da

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdclt.exe · signed by Microsoft Windows

dafb903d3aa945c4ac01011e38f3e232d6be8b7f9b66b7c3ccb1a1ecfc1b7a90

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sdclt.exe
mediumPotential UAC Bypass Via Sdclt.EXERoberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Sigma names sdclt.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.