CmdID

CmdID / Files

sppsvc.exe

Microsoft Software Protection Platform Service file version info

Program on Windows 13 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real sppsvc.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Software Protection Platform Service

13 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sppsvc.exe · signed by Microsoft Windows

b0d0cff7bcbd79c303d736717b8696e60cefad8dbb4bfa7966135701a95b6729

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

0468f965ddc8ef2839d9a5e5f127ba940084f9d913ad6cc82201b303a1b10bc4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

168fe518b3ad803a325308ae316ea0dce0be93b71201ce3ecdece1ed633c17b4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

51459a8df8318b7c7505a107a34c6e008727501f61d122724eddeeafc465df83

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

925f864865ae0f552356da34008e77b231da3e525314ffbdbc62e8955ca091ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

f7db353c7f32e266c9af7b650320a0f56144b064ca54acc57dfade7d99cb0659

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

fb0371d958bcc0ade0b75c4ef7072296b1a0e16e05a1193b37068f44765bd12a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\sppsvc.exe · signed by Microsoft Windows

1c9442e8cee197fc16e6148387a8a4b8b9a7a0ba19c57afa41f4b42ec635b174

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

04cf5a7ddb377c741a788f520409e18c98e08a1002cba26e83806a965a919a74

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

e508a3816a1073c0a4e83b2a7c02d0b57df6a8b473ad77c530c9691245607f52

10.0.17763.1 (WinBuild.160101.0800) · C:\windows\system32\sppsvc.exe · signed by Microsoft Windows

f8d3311e35541ce65a5aac5ebce7dc41ac2ada4d02585590b4d2844c7549a98f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\sppsvc.exe · signed by Microsoft Windows

b2eafc6e62057cd9285d9e00005880c11ff778f0f6facb6fb21dfb5a5dfd688a

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\sppsvc.exe · signed by Microsoft Windows

cf22d703fa779be84e3957e7a18ef4837b1328914b2634898bbcabe08bd239c1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name sppsvc.exe
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)