snmp.exe
SNMP Service file version info
Program on Windows 4 known copies with hashes 1 Sigma rule names it
Is it the real snmp.exe?
C:\Windows\system32\C:\Windows\SysWOW64\4 known copies
10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\snmp.exe · signed by Microsoft Windows
96a2a129964da76b8ad62b0fa7f0670c91ec2ed2c717950a09aceba30da6aea410.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\snmp.exe · signed by Microsoft Windows
e0fcb5c932aef624e5d83e95d28b6e1dd50819c3800e01b0f05b7a3db13c598c6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\snmp.exe · not signed
097ae6a614dc7be1b559ad1fcb645e69da3a65e624c784657f168265442c76396.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\snmp.exe · not signed
0bfe47aa494ec081ca3a1e516201e52d93d6052a391c347344f764c99f066b1dFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names snmp.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.