CmdID

CmdID / Files

SecurityHealthService.exe

Windows Security Health Service file version info

Program on Windows 11 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SecurityHealthService.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Security Health Service

11 known copies

10.0.22000.100 (WinBuild.160101.0800) · C:\WINDOWS\system32\SecurityHealthService.exe · signed by Microsoft Windows

1b61da3e9192984da05194c58518dfa1ae7306e953905995af9f0cabf2359540

4.18.1907.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

14798b8c718061bc6baafe9b3823e7d8aa387a4eb486a34b629d019482761b51

4.18.1907.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

265d4d30a5998c7f38ba187300cac868107826dc93a82e4009a887cac26b1fef

4.18.1907.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

5289a73420025011620b737d5e66198b787b6ee3d9061e1fdbd20e541f421eff

4.18.1907.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

8a33da8cc05398c29688c5bb4d8643ee055f9e707fdbc80815ccfadad7824c2c

4.18.1907.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

cfb7dd7e63343d5f863468737677158d9a5e207862bd3361c96e88094a0d69e3

4.18.1907.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

da04fb5cf7e65d7ea011362e8bfec80bff7f02c3b70b351fdd9c4c33ac124b04

4.18.1901.16384 (WinBuild.160101.0800) · C:\WINDOWS\system32\SecurityHealthService.exe · signed by Microsoft Windows

42b9b2200afdcdd1acae40fd7c273309d2b2f0c17cd26cb03a9dca2b65538d33

4.18.1807.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

25aff17bdaf331ade6418ba8cf6bf34f24ff153d1dfa2a9ebe31d1b10e362a38

4.18.1807.16384 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

61b1bca1ef2073482c5a14fd9f5db31fe54aad61ffa8da2a708ba974912c037c

4.18.1807.16384 (WinBuild.160101.0800) · C:\windows\system32\SecurityHealthService.exe · signed by Microsoft Windows

856be77e882fd64bffbddf7d543fd59749ec4985e8fee759d8268a11b65e2670

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SecurityHealthService.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.