ServerManager.exe
Server Manager file version info
Program on Windows 3 known copies with hashes 4 Sigma rules name it
Is it the real ServerManager.exe?
servermanager.dll in the file’s header: a renamed copy still carries itC:\Windows\system32\3 known copies
10.0.17763.168 (WinBuild.160101.0800) · C:\Windows\system32\ServerManager.exe · signed by Microsoft Windows
57fb008faeb05dd34fc1c224ce456b38ced950243fbac7f7cb348df68f990ebe10.0.14393.2608 (rs1_release.181024-1742) · C:\Windows\system32\ServerManager.exe · signed by Microsoft Windows
a143f35f4f8674340f71a4669bcd8e7f82a6fc3e2fb682aa56b2d4e1e153a7b26.3.9600.17238 (winblue_gdr.140723-2018) · C:\windows\system32\ServerManager.exe · not signed
ffb509f4a4e6619fb4535de95a41e7bdf08ac919ac564378e14411440ed9c6a9From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names ServerManager.exe in 4 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.