CmdID

CmdID / Files

SecEdit.exe

Windows Security Configuration Editor Command Tool file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it Command secedit

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SecEdit.exe?

file version info and known copies
Original nameSeCEdit in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Security Configuration Editor Command Tool

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SecEdit.exe · signed by Microsoft Windows

06ae5a23eab781022bd2be2d68075f1373121c703da1bc664d18442e6dd44206

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SecEdit.exe · signed by Microsoft Windows

22e6324db60ae1d66650557114a46a3afaf445b034b347813626b10e3abc023b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SecEdit.exe · signed by Microsoft Windows

56cb815f0fda92c4658296692e4f70dee557137528482fe7a834296bfdb710c0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SecEdit.exe · signed by Microsoft Windows

58348e21fb9ae1582e68aa07bf21f87d58db03fe12123b0df5bfb3a7e168db26

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SecEdit.exe · signed by Microsoft Windows

11e35f6edbd4e7832311b035a6287fd33b001001288dc92d518692067ff1464a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\SecEdit.exe · signed by Microsoft Windows

4244799b7ea42ef73f9dbb45c5b89c8a653f1d495c982fe8ee4d1d446037aafd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\SecEdit.exe · signed by Microsoft Windows

343e8924ea917f83ded38fff89675a233011d82b2aba9d4a9675c24a039f5be5

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SecEdit.exe · signed by Microsoft Windows

fa402723445b88a6050d5b7d003b13a7118aa32bf3558dad1d50c6fe2ac6a16d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SecEdit.exe · signed by Microsoft Windows

512a82b381339f4f5772b3669e341c40c8f27474152afd41b5412d8a5d341401

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\SecEdit.exe · signed by Microsoft Windows

72d0ea92ab75c3e740d95f4faa9dac82c2089565c3ea28aedf9b56fea7eb6c0b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\SecEdit.exe · not signed

14376ddd07cf8df48803a3c0e606a66f6250bbe56e6fd99e83553ed617fffed8

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\SecEdit.exe · not signed

d24642e2194d6f09b886990eafa0a40803ee53ea3f9d142435b5214291dba062

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SecEdit.exe
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe