CmdID

CmdID / Files

smartscreen.exe

Windows Defender SmartScreen file version info

Program on Windows 7 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real smartscreen.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Defender SmartScreen

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\smartscreen.exe · signed by Microsoft Windows

be288c1c68fd64a0facd30159aeb8f1d36892550725231afec2b4c2c354d861e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\smartscreen.exe · signed by Microsoft Windows

1e35bb9770ae8202bd6d2e5fda6784a80f67dcf4b547b206a14d82cc17154842

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\smartscreen.exe · signed by Microsoft Windows

9605680fc164acb985c031eca2c8bc4909cf8b749c571db6de2b0b2c204c2163

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\smartscreen.exe · signed by Microsoft Windows

b790b17ea61fc4edc3d385ff83d0bc565a41594bb86920deef990a83b8862097

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\smartscreen.exe · signed by Microsoft Windows

533a950b1b8a63226573e93604c11c241ab1ae34e1be47d9919882a1681acb42

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\smartscreen.exe · signed by Microsoft Windows

f740fba7b6791abf3e000a6c4a04ddee68d0a0722a3f5c0b44eb4e4d713bf7c9

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\smartscreen.exe · signed by Microsoft Windows

1a6bb7f3ac6574998d7628b65ab234e1d0955f8643f4713c63e236f5fb4dab92

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name smartscreen.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

Sigma names smartscreen.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.