CmdID

CmdID / Files

TieringEngineService.exe

Storage Tiers Management file version info

Program on Windows 7 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real TieringEngineService.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionStorage Tiers Management

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TieringEngineService.exe · signed by Microsoft Windows

c2c6583349324cbfb1e474fdc20d7b9ca11bb3f7b5c04f7ebf395983e6e4746f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TieringEngineService.exe · signed by Microsoft Windows

2b871b446cd18d9f8461e5e7c56c2fd3530f06fded609b8e5a145348c27cb53f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\TieringEngineService.exe · signed by Microsoft Windows

4ccdb591ee16507879d8f12c0bdd40facbeef03bfc553a84270284d4930b433f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\TieringEngineService.exe · signed by Microsoft Windows

7abfd8534338904819797a8346c854100334ed79d3915a51b8cf1d3f9f335393

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\TieringEngineService.exe · signed by Microsoft Windows

917f104892ff1890be2ab218b99c2dfed8287ab93ea6895ba74090783d4e341c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\TieringEngineService.exe · signed by Microsoft Windows

613247f0e362a109090e8563d977decc50c64d45d6962905fa84a2d59329045c

6.3.9600.17396 (winblue_r4.141007-2030) · C:\windows\system32\TieringEngineService.exe · not signed

fd08ac764e086f40a53efc6d531a70aa8c63e608ec52cd7696ff5020d0abc168

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name TieringEngineService.exe
highRedSun - Conhost.exe Spawned by TieringEngineService.exeSwachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost

Sigma names TieringEngineService.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.