CmdID

CmdID / Files

SenseCncProxy.exe

Windows Defender Advanced Threat Protection Communications module file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SenseCncProxy.exe?

file version info and known copies
Installed inC:\Program Files\Windows Defender Advanced Threat Protection\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Defender Advanced Threat Protection Communications module

4 known copies

10.8040.19041.1320 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe · signed by Microsoft Windows

068fc34cdc7b9598b6cb8b6eb52368d6795b66f60e4ce2738ef707da01bec24f

10.7430.19041.488 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe · signed by Microsoft Windows

503cbeb62a2d08c9197568fc6b8a401c11f9126aeb0afa6e282128b9af6c86dc

10.7430.19041.423 (WinBuild.160101.0800) · C:\program files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe · signed by Microsoft Windows

c6b164193ffd03e00f37224f1bc5852f7b34bf40d3437d1164cf4e1b7872d370

10.7410.17763.1490 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe · signed by Microsoft Windows

1f44cb03b35a5f994cf9b70d2399f8a6a3446de3a85f0d88791045898742eebd

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SenseCncProxy.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.