CmdID / Files

taskhost.exe

Host Process for Windows Tasks file version info

Program on Windows 1 known copy with hashes 3 Sigma rules name it

Is it the real taskhost.exe?

file version info and known copies

Installed inC:\windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionHost Process for Windows Tasks

1 known copy

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\taskhost.exe · signed by Microsoft Windows

b79e0890e5acffe7966bb32a6aaa415d6e334d0df5452debe6a867bb03451ea6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name taskhost.exe

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

lowWindows Processes Suspicious Parent Directoryvburov

Sigma names taskhost.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.