CmdID

CmdID / Files

unsecapp.exe

Sink to receive asynchronous callbacks for WMI client application file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real unsecapp.exe?

file version info and known copies
Original nameunsecapp.dll in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\wbem\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSink to receive asynchronous callbacks for WMI client application

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\unsecapp.exe · signed by Microsoft Windows

498760eb880b550c408a5204bfec1775a161bc4781828cae84626298b90200b3

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\wbem\unsecapp.exe · signed by Microsoft Windows

5cd0dd3b1454b437362c87c651ee2068ac27cdb725aa1c705cf62ff325a759cc

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\wbem\unsecapp.exe · signed by Microsoft Windows

fabb8cc6de82a79f1eed0976e5ce741ff3b9d5b1b40d90146052f4393cca80a3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\unsecapp.exe · signed by Microsoft Windows

1279842635c51d65672931d0acedeb2e3b54d2a4b9e77568bdf2ed380ca40ae8

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\unsecapp.exe · signed by Microsoft Windows

bf2dd57424661710a5db7eaa5574510179489be9002c964f28f6331546d087bb

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\unsecapp.exe · signed by Microsoft Windows

8095d4d7726438f8665e00c1a405ab94db6358dc14740783795cf8617a64f19e

10.0.14393.2515 (rs1_release_1.180830-1044) · C:\Windows\system32\wbem\unsecapp.exe · signed by Microsoft Windows

20f499d581cf4af331d8ec8b1e07a32cc1a695ef6790b51da5ee223c5867154f

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\wbem\unsecapp.exe · not signed

7df67e2e0ad0d26b378eedae9d517b420c7d17715a95a0b1daf29b12c239fed5

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name unsecapp.exe
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)