CmdID

CmdID / Files

SenseIR.exe

Windows Defender Advanced Threat Protection Sense IR module file version info

Program on Windows 4 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SenseIR.exe?

file version info and known copies
Installed inC:\Program Files\Windows Defender Advanced Threat Protection\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Defender Advanced Threat Protection Sense IR module

4 known copies

10.8040.19041.1320 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe · signed by Microsoft Windows

767661001636521c6fa9923d0e41f75d2eb8bade1b8d155bc0648d458ebfd8e7

10.7430.19041.488 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe · signed by Microsoft Windows

4d8373d3be443392db9dd1fa80a5861962b32ce5b9b82593b69c0b343fe35d6d

10.7430.19041.423 (WinBuild.160101.0800) · C:\program files\Windows Defender Advanced Threat Protection\SenseIR.exe · signed by Microsoft Windows

859f070003dc85da745bd5d2af2d731edcc373cb789108eacd7a1da9f4fdbc3a

10.7410.17763.1490 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe · signed by Microsoft Windows

6f839e0cabd582352403bf744af6d550bcf7049039e8216e4f7e35b4b173e27a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SenseIR.exe
lowNon Interactive PowerShell Process SpawnedRoberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)

Sigma names SenseIR.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.