CmdID

CmdID / Files

taskhostw.exe

Host Process for Windows Tasks file version info

Program on Windows 8 known copies with hashes 7 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real taskhostw.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHost Process for Windows Tasks

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\taskhostw.exe · signed by Microsoft Windows

da30dd11e22890c29f33b017b6dcd5e28977518dd93fc503778ce1af2426dd7b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\taskhostw.exe · signed by Microsoft Windows

0322728dbce3a577c4a13b907ad7375d27e74880b63f7371384f67d19197a0ad

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\taskhostw.exe · signed by Microsoft Windows

59c34f131dcedcc34252d2ab18754481843efb2a64a92996391330c321154943

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\taskhostw.exe · signed by Microsoft Windows

72279ad47eed7fbf2472214824696351b9cb2571b8ee5d8c92fada23b378d812

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\taskhostw.exe · signed by Microsoft Windows

f58b368e051ef114719db91e1e82db81e8274a0c9f1286a39b00d9ebb6fde330

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\taskhostw.exe · signed by Microsoft Windows

0bec3128b241fa533dc5a9d3f62aa41323d205defc30dcde228c5ecc2d1e50a9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\taskhostw.exe · signed by Microsoft Windows

ca620f4de4a426f129445e4d8a545b7b08b021080e7375a3ea3ed8c8a7212a8f

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\taskhostw.exe · signed by Microsoft Windows

1876990eebc99f0b0f66bec435fe2810e450532e23e22427da31a09802394461

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name taskhostw.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names taskhostw.exe in 7 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.