CmdID

CmdID / Files

spoolsv.exe

Spooler SubSystem App file version info

Program on Windows 10 known copies with hashes 12 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real spoolsv.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSpooler SubSystem App

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\spoolsv.exe · signed by Microsoft Windows

ed8dd3b055882e112d70e6f85acb1e8652880b703ee44416e96dad8b867baca1

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\spoolsv.exe · signed by Microsoft Windows

00ac7e58dfc2f6757c0c2268eb441e4e8fb317427840971a1049011cd2888a35

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\spoolsv.exe · signed by Microsoft Windows

120da7561842ab914590eba1a13e2f1a8171198c47fa0543c5fff9948a2372c0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\spoolsv.exe · signed by Microsoft Windows

4ccd2f52f39cc72787bb4cac73befc5d27e2e77b14e70b04cf604159d19313b4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\spoolsv.exe · signed by Microsoft Windows

c58a7fc742d9f2dc0cad8cc87df657cbafbd35bbec4e22bb42350cae6eaaab4e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\spoolsv.exe · signed by Microsoft Windows

13b3e4725f07a2371b7b45bb3e53ed14438abc38ced045d50bff3dc840680c59

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\spoolsv.exe · signed by Microsoft Windows

0d7bed96aa8ff03531cfe355936a785cf8694d57f8d8e2906c2ace83a5a1ed4e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\spoolsv.exe · signed by Microsoft Windows

5c9ceb1df468af22bf96c87acaebe58ec2cc936cfc89dcbd18d0684c72c32c78

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\spoolsv.exe · signed by Microsoft Windows

c37a2c7cbcb14c5686bc8dd195cb1dbefaa6e664cf020ef32fdbc997d5af9314

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\spoolsv.exe · not signed

8304796552a5964aaf0561bb2ddda63edbbfe4502419e9cf037cb95cda57eec1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name spoolsv.exe
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names spoolsv.exe in 12 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.