SrTasks.exe
Microsoft Windows System Protection background tasks. file version info
Program on Windows 3 known copies with hashes 1 Sigma rule names it
Is it the real SrTasks.exe?
C:\Windows\system32\3 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SrTasks.exe · signed by Microsoft Windows
58a7644b6b850a4a8a73d9846d625f51f86ea223c70d061c35e4e3b5bda63eee10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\SrTasks.exe · signed by Microsoft Windows
40e27a9039a2e4a731ea6a74291840fb13c679a1e8ae5b523016aa15727d8a5810.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\SrTasks.exe · signed by Microsoft Windows
dd8b82abb81377966076a4c53f54fdb1aed85be2370aede7589b8116204055e0From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names SrTasks.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.