sh.exe

Program on Windows 2 known copies with hashes 17 Sigma rules name it

Is it the real sh.exe?

file version info and known copies

Installed inC:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\
C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.4\resources\app\git\usr\bin\

Signed byGitHub

2 known copies

Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.4\resources\app\git\usr\bin\sh.exe · signed by GitHub

74fa78e454d95616117b835f0bd622d33531cbc7d300c01ca778effdf2c1bcf6

Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\sh.exe · signed by GitHub

b49635beba631b45cb6ce0ab1350befae7852c8d937f49abee25360a185d654c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sh.exe

highMMC Spawning Windows ShellKarneades, Swisscom CSIRT

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga

highSuspicious Curl.EXE DownloadFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious MSHTA Child ProcessMichael Haag

highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io

highSuspicious Microsoft OneNote Child ProcessTim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)

highSuspicious Outlook Child ProcessMichael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis

highSuspicious Serv-U Process PatternFlorian Roth (Nextron Systems)

highSuspicious Shells Spawn by Java Utility KeytoolAndreas Hunkeler (@Karneades)

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumPotentially Suspicious PowerShell Child ProcessesFlorian Roth (Nextron Systems), Tim Shelton

mediumSuspicious CrushFTP Child ProcessCraig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)

Sigma names sh.exe in 17 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.