CmdID

CmdID / Files

SecurityHealthSystray.exe

Windows Security notification icon file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SecurityHealthSystray.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Security notification icon

4 known copies

10.0.22000.65 (WinBuild.160101.0800) · C:\WINDOWS\system32\SecurityHealthSystray.exe · signed by Microsoft Windows

641d28ff6acbdcffcdd1c9e92d52252150e5e446704fd3fad4a3539683d3af0a

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthSystray.exe · signed by Microsoft Windows

570b37a7a3ffdafcceccc33cbc1968feb857b73ca3cb4dffedc2e67e9abd0878

10.0.18362.628 (WinBuild.160101.0800) · C:\WINDOWS\system32\SecurityHealthSystray.exe · signed by Microsoft Windows

7f2fe5ed8fa26f044dbbb0db6b633c8feaa2c683880d5c3842a5927f85a2d3be

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SecurityHealthSystray.exe · signed by Microsoft Windows

48f852164ef4747fcddff463034cad33167e341d241536b122ae74fc8841c941

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SecurityHealthSystray.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.