CmdID

CmdID / Files

tshark.exe

TShark file version info

Program on Windows 1 known copy with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real tshark.exe?

file version info and known copies
Installed inC:\Program Files\Wireshark\
Signed byWireshark Foundation
ProductTShark, The Wireshark developer community
DescriptionTShark

1 known copy

3.2.7 · C:\Program Files\Wireshark\tshark.exe · signed by Wireshark Foundation

2530bc472f4c73b19c6a2d99c5879c6943279f7c18e37f89f1e58aec32701625

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name tshark.exe
mediumPotential Network Sniffing Activity Using Network ToolsTimur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems)