CmdID

CmdID / Files

SearchProtocolHost.exe

Microsoft Windows Search Protocol Host file version info

Program on Windows 20 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SearchProtocolHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductWindows Search, Microsoft Corporation
DescriptionMicrosoft Windows Search Protocol Host

20 known copies

7.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

65ef4a9763abe4de4ecd2efcdb6f53ca508ed81f99af346f95718323eed5c41b

7.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\SearchProtocolHost.exe · signed by Microsoft Windows

e9846557aac226d991752f6eca62395e5d9bced7311d30ce888c8e23b5713656

7.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

59cc005c70a7e16bd2e0c8df3daf7e6f9fca5b49a7a377a62775480579a5252f

7.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

7b80a59d171be36ecfe71488827eeaf882495b2b109a0619d33a8687887ca489

7.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

0bb9ca31805a2507933710126c929edeb5d6c741fb98fcc6bfe59eb1c8545b13

7.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

92a7c72e68e22c6564f1f5c8a3745ab807754d4976b23328a68dab5fd62cf254

7.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

027f24a0b6bf688f01c389d619091edd7a77a53368a944f77a2821ab2d32d5a0

7.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

8c53e6abcbecc1e9e5f6cb5faffd363100f769b9b2e128c66f9f3c5735425659

7.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

7d83d95776cfc93a8fc3502e8e6806d5ab72ab71b209a0cebc69412de61371bf

7.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

81c14aeca01720921dddf5c180bbd415bcd7767945f1bd57897cbd52bc167e49

7.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

38b3410272da72cf7f05be755cfa675f51a35f4687fd02867062bd7fc0bd316e

7.0.18362.719 (WinBuild.160101.0800) · C:\WINDOWS\system32\SearchProtocolHost.exe · signed by Microsoft Windows

6fac724f53628e0d8faad0049635b2eb1e16f6629ddb48106dc611c25a6b0134

7.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

0c18644b7b7a04ce50620fb622b4a424766deb31b0d8af608af15ed5336f122d

7.0.17763.1490 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

4c17b29541a680eb3e9d11b2031f1dd3f4074b4708ba704948216b0dcf231318

7.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

5e11e86c05b3ea5c022b5a09e4ba45a626c33b405c8829488e0642bf6ad1f828

7.0.17763.1369 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

927b3a2d8bddb1de75562125d83861716ae387e620025c271bcf95fdd998ea2b

7.0.17763.1098 (WinBuild.160101.0800) · C:\windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

25e66d30d30cc0c1887043429da5805deb8b5f064217670d35dcf058d7a7a709

7.0.17763.1098 (WinBuild.160101.0800) · C:\windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

4415edc9e020f5c583729bcc43b7e32e9fe4c055e714580143cb0756b7c52acb

7.0.14393.3564 (rs1_release.200303-1942) · C:\Windows\SysWOW64\SearchProtocolHost.exe · signed by Microsoft Windows

32085dce24e76458809da5322fec32c3215ba94ecd521beb4d4d36fd398b1f22

7.0.14393.3564 (rs1_release.200303-1942) · C:\Windows\system32\SearchProtocolHost.exe · signed by Microsoft Windows

8b5e687034b1e7003485bb648ae831f17adf0893570c9833b9d5e2f13931d3ac

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SearchProtocolHost.exe
highPotential Pikabot Discovery ActivityAndreas Braathen (mnemonic.io)
highPotential Pikabot Hollowing ActivityAndreas Braathen (mnemonic.io)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names SearchProtocolHost.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.