CmdID

CmdID / Files

SearchFilterHost.exe

Microsoft Windows Search Filter Host file version info

Program on Windows 19 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SearchFilterHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductWindows Search, Microsoft Corporation
DescriptionMicrosoft Windows Search Filter Host

19 known copies

7.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

96a3d84c4ec4f3ef5bac95e8941023b1cff248b9e030841d60b23ae476b48d4f

7.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\SearchFilterHost.exe · signed by Microsoft Windows

c1e86197124463163202c88daf8ddfb84ca359b9bbb14e50f7ceff256178d611

7.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

c80bf01b08858862e714995c669c3b3687614da4ac20798248e413d7f62ab2b5

7.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

ffbcf5f709e1e017eac64af5c9e232140fca2d1a02a64c1fffd965b1e5ab842f

7.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

4d1ca90290411013b6a91c6c0d2595a0529c24ab60de4750bbd195c2d2781359

7.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

9d2d77f7dd153878b2ccb18d8b12a35a743efab598cb6475bfc72a539ac77a05

7.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

3596ce0d573803e261b0186d986842cb3ca80d40b65392310d13a7557f71c0a5

7.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

d2603e6540eb2439ad53d29da0f243914db6ffb67a9a92f6e360f77498129b4c

7.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

39e103b2dff413c527a75b8384119c57836852dd3a1fb1026f30e0b335732675

7.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

3be3bd2c06c9ff4f40ae1e605fb0044f2d532d8730e6df2c3cc8cfad3df387a2

7.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\system32\SearchFilterHost.exe · signed by Microsoft Windows

1584a43ce318552e1191e3b550eceb1b8e291c6d5444e72e1fc71636a0f800c9

7.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

cc7c85554c720281d2d2bfba3d667820a6c17f53da5a92af49179adfb425d545

7.0.17763.831 (WinBuild.160101.0800) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

574d2d970451b89b6c646253345628aa692cf76f6a6fe4404086d20caeb6a211

7.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

a7267e3e9bf56add286d9799c43a548264fb2146c6abd93101db5eeb4bcea2f0

7.0.17763.1098 (WinBuild.160101.0800) · C:\windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

b77f100bb6c4f3db1ba5fcede4f1efa5d065700bcabb365266dd494c5d8a049b

7.0.17763.1098 (WinBuild.160101.0800) · C:\windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

bfeb65feafe356a44f6cc24d1962317c772abc58a847a200f93c5db69c93e98b

7.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

dd8a449737ca241bf34be50df7acf09bb62af97cc6ae8e6e5b4cccb6da7f4dec

7.0.14393.3564 (rs1_release.200303-1942) · C:\Windows\SysWOW64\SearchFilterHost.exe · signed by Microsoft Windows

25a3403a8238db8f6fd4b6de4113334007707f08440c7d45fbdd58747ac5835b

7.0.14393.3564 (rs1_release.200303-1942) · C:\Windows\system32\SearchFilterHost.exe · signed by Microsoft Windows

ac1295debaf51d3562705376eef6e8ac74dcd93df53d30f5eceacacbbc45c5f2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SearchFilterHost.exe
criticalWinnti Malware HK University CampaignFlorian Roth (Nextron Systems), Markus Neis
highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io)
highPotential Pikabot Hollowing ActivityAndreas Braathen (mnemonic.io)

Sigma names SearchFilterHost.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.