CmdID

CmdID / Files

SenseSampleUploader.exe

Windows Defender Advanced Threat Protection Sample Upload module file version info

Program on Windows 4 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SenseSampleUploader.exe?

file version info and known copies
Installed inC:\Program Files\Windows Defender Advanced Threat Protection\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Defender Advanced Threat Protection Sample Upload module

4 known copies

10.8040.19041.1320 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe · signed by Microsoft Windows

0ea3a557bdc949895a78ec661a6694958b7a871faa0bfdc204967b1be7e7eb16

10.7430.19041.488 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe · signed by Microsoft Windows

ded30fdf9b12da4db599293fe4a036b6fd9792cd9844dec3cc148e7635daa31c

10.7430.19041.423 (WinBuild.160101.0800) · C:\program files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe · signed by Microsoft Windows

ad4ce4dbb5e6c9f2472315a0d2972ed881bffa5d0125ea79ff2a010068befe58

10.7410.17763.1490 (WinBuild.160101.0800) · C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe · signed by Microsoft Windows

aa782115462aa5fb96b5d240d2057d1e825db3cb8e38dd878a449209e9a7d7e8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names SenseSampleUploader.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.