CmdID

CmdID / Files

SIHClient.exe

SIH Client file version info

Program on Windows 9 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real SIHClient.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSIH Client

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SIHClient.exe · signed by Microsoft Windows

9344007d147845aaa177f3fb590ac3e5b09a6cdb1461f371568b7e2bfe1279be

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

2765b204b66737c10c5e8e04aff91aa80f851cec28d4fa941ffb81e6f05626e3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

5a299f6fbe0e5ecbd1622f4ece9c475bfcef37db0bd991c034597a587062e900

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

9f2fe7d4d0adcc5603061b13d4137d9eb6b70c8237155efa89ca1e051404e176

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

a167b3de2df58ab035602223daf33fc807f01fbe901edc7bd1913b43d5172541

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SIHClient.exe · signed by Microsoft Windows

274a9e80a5848d339c1fdb308ef67b255841b698e680719a5a9bee893f0e34f0

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

0e0bb70ae1888060b3ffb9a320963551b56dd0d4ce0b5dc1c8fadda4b7bf3f6a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

fe7054c47862ca79944fae4f6892cb75000d4196dc9b739993b052817b89d688

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\SIHClient.exe · signed by Microsoft Windows

89ef3c211e59258dc7242a71b4e4bb7e517de253fd4f2fa5b1adf3877caff081

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name SIHClient.exe
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names SIHClient.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.