CmdID

CmdID / Files

sdiagnhost.exe

Scripted Diagnostics Native Host file version info

Program on Windows 12 known copies with hashes 8 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sdiagnhost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionScripted Diagnostics Native Host

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdiagnhost.exe · signed by Microsoft Windows

3c3ceb6e016b1b938912d4f341a2fd7799f7a38b81a68981a77c5a01f75d4109

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sdiagnhost.exe · signed by Microsoft Windows

efc329587ca237257b39778942357b7185d0ffe970e4ef549e05c097bb9dde21

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdiagnhost.exe · signed by Microsoft Windows

3584436e99bd2d420e9066e3a237ed1be41e964e92fb5e1c88e052e6c834b1da

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sdiagnhost.exe · signed by Microsoft Windows

761815301a00d0b3a7bb4959a5004b623c55009ce701c6e867c96f468dc1323a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\sdiagnhost.exe · signed by Microsoft Windows

54068377f0997d166285efab83c50ab7d17a3f1ed87b750a0f9c91d3dc95a689

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sdiagnhost.exe · signed by Microsoft Windows

de77562e0bdd86a685d0c930122481f69e6a9ef9f2cb023bca0dcfec05d245e5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sdiagnhost.exe · signed by Microsoft Windows

50a816fe57195376ad30aeec2ea7968936a706508e26299302f30366cc7ff3a4

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\sdiagnhost.exe · signed by Microsoft Windows

b2adf4cb63c8b1b2ff014bd328deac96354c6f834faf0660efd8f7e89f1b2399

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sdiagnhost.exe · signed by Microsoft Windows

6fedaaf41148f8e0803451b44aa5270ae6f96bf6d31cb81b3fe9459d2239e54e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\sdiagnhost.exe · signed by Microsoft Windows

943bb9d1ac027133ee5cb1461b3359993eeef0a799dc85f9e4ab9cd57dd8f281

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sdiagnhost.exe · not signed

480aafbf73786afdb295f1db4e2cc26ce962eefb38669c14672590c5e11a3c5a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\sdiagnhost.exe · not signed

bbf6d9ed2664f6bfcce40348a0cbd73c55ba364cec8649b2bf332e3301ed7a19

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sdiagnhost.exe
highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
highSdiagnhost Calling Suspicious Child ProcessNextron Systems, @Kostastsale
mediumDynamic .NET Compilation Via Csc.EXEFlorian Roth (Nextron Systems), X__Junior (Nextron Systems)

Sigma names sdiagnhost.exe in 8 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.