CmdID

CmdID / Files

smss.exe

Windows Session Manager file version info

Program on Windows 8 known copies with hashes 7 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real smss.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Session Manager

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\smss.exe · signed by Microsoft Windows

be09b15c760cd37ccab1e227cf0ce829e8efb1c88840e14ed9e48cfcea1817ab

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\smss.exe · signed by Microsoft Windows

56afe5133fdc5806ec6b19436f7b55f1499cfc94619740c171424fbcf7808fd3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\smss.exe · signed by Microsoft Windows

5c0faebcede7821dfbce95abed8b85bc25e19489ea6cf4d404a54e4e366a5e88

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\smss.exe · signed by Microsoft Windows

e11ae324ba8c7ad66869bc34d16594f053c9447f0b11bf8d147da259ad19dc92

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\smss.exe · signed by Microsoft Windows

5f48638e3397204c2c63d7b76d025d62302d0e45fc5055c0a692b0bbc7e6b337

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\smss.exe · signed by Microsoft Windows

b6e357b520478920810317b363aa539595d386bc5ef3d5cf9581f325026ba397

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\smss.exe · signed by Microsoft Windows

56881bcaeac350107a6453f38f020fe0e284dbe2e8a6f37ed482985e0dd98ea7

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\smss.exe · signed by Microsoft Windows Publisher

fc8ef5704c871187ae4945000db3d3758e8b867e90f8e530b0f12c6438d17d35

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name smss.exe
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)
mediumSQL Client Tools PowerShell Session DetectionAgro (@agro_sev) oscd.communitly
lowPotential Executable Run Itself As Sacrificial Processfrack113

Sigma names smss.exe in 7 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.