CmdID

CmdID / Files

sihost.exe

Shell Infrastructure Host file version info

Program on Windows 6 known copies with hashes 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sihost.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionShell Infrastructure Host

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sihost.exe · signed by Microsoft Windows

6b7ed70e0728d01c277ed90a1b4f538e17b009054b435792dc589022838e72f9

10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\sihost.exe · signed by Microsoft Windows

8ee21a0ba8849d31c265b4090a9e2ebe8ba66f58a8f71d4e96509e8a78f7db00

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sihost.exe · signed by Microsoft Windows

c2194f45c7b614b4520ed551c88c2b32d2e0065edcf3d7208086a1b0ec07d835

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sihost.exe · signed by Microsoft Windows

40a86a19ef9afa0021ca59d08454034e6a6c37d620be583c26e05e1d55d11ca0

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\system32\sihost.exe · signed by Microsoft Windows

fdf2362a69c542996a8ac84b938de62ca97ac209762171d2f8b6b543d3a966d0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sihost.exe · signed by Microsoft Windows

32fabbc09ca776a819d40cf3e33a3fe44bf1db72ea351845b20ed9ff528b64d4

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sihost.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names sihost.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.