webexmta.exe
Cisco WebEx MTA file version info
Program on Windows 1 known copy with hashes 1 Sigma rule names it
Is it the real webexmta.exe?
Installed in
C:\ProgramData\WebEx\WebEx\T33_UMC\Signed byCisco WebEx LLC
ProductCisco WebEx Meetings Troubleshooting Tool, Cisco System Inc.
DescriptionCisco WebEx MTA
1 known copy
3303.0.1806.2100 · C:\ProgramData\WebEx\WebEx\T33_UMC\webexmta.exe · signed by Cisco WebEx LLC
22a0d6a981c0262ab34908f5862c074cfcb2cfdd39770743fbe7d2133a57f56eFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names webexmta.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.