taskeng.exe
Task Scheduler Engine file version info
Program on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real taskeng.exe?
Installed in
C:\windows\system32\C:\windows\SysWOW64\ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionTask Scheduler Engine
2 known copies
6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\taskeng.exe · not signed
74b9cf472d5008e00735482f084f886eaa201248d6e87ab6b1990e3670bd66936.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\taskeng.exe · not signed
9137b804681b06e87dfd6f548f9cecfda0da5aa17cbe0e673032ec465168c9f1From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
highHackTool - Potential Impacket Lateral Movement ActivityEcco, oscd.community, Jonhnathan Ribeiro, Tim Rauch