CmdID

CmdID / Files

tasklist.exe

Lists the current running tasks file version info

Program on Windows 12 known copies with hashes 5 Sigma rules name it Command tasklist

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tasklist.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionLists the current running tasks

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tasklist.exe · signed by Microsoft Windows

1cc4cb74fdd5deecccd55b39a642e069ee42f0b1ec81ba4cf8b743d2a6a43296

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tasklist.exe · signed by Microsoft Windows

b9e8ca03fe76007b98f88e184aae32d6e2025415a04cb9e8edb7a40373e69f7c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tasklist.exe · signed by Microsoft Windows

76eac7b5f53e0d58a98d5a6ddf9c97e19d1462ef65c0035d7798f89988b15ab4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\tasklist.exe · signed by Microsoft Windows

be7241a74fe9a9d30e0631e41533a362b21c8f7aae3e5b6ad319cc15c024ec3f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\tasklist.exe · signed by Microsoft Windows

9f60240830faf4de590360561a6e249f5d0c41ff8afbb9498bbe5c1a80abd02c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\tasklist.exe · signed by Microsoft Windows

e25a51d329b8355d6a297e10e26f572496b6030c827bcf12b736fd3a5096b20c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\tasklist.exe · signed by Microsoft Windows

113c4d989a47b80905e92c06e48e03b24d44cadbf7bc7e86d948d7da9dc98252

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\tasklist.exe · signed by Microsoft Windows

b4a874c5ccfa9a698e4a56d7453105cc7617802c385abe1603760a9bb33d39ed

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\tasklist.exe · signed by Microsoft Windows

27eddac6a2e5a74df67c534393b0b025b03d61310748be016dce348a02d30a22

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\tasklist.exe · signed by Microsoft Windows

9125887b50465ce6f7429a83bee647f723e391a42501a017b5edd939b6b95cc9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\tasklist.exe · not signed

85cf61445bff8550394308f2cb1d81be7380789b3d90e8230bd91757154c0b00

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\tasklist.exe · not signed

d89ab72ad8a071593be0f48c5fc0fc40802c1bdea05e39aebbf26fabe2fefece

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name tasklist.exe
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process Of SQL ServerFPT.EagleEye Team, wagga
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
mediumLoaded Module Enumeration Via Tasklist.EXESwachchhanda Shrawan Poudel
informationalSuspicious Tasklist Discovery Commandfrack113