CmdID

CmdID / Files

wevtutil.exe

Eventing Command Line Utility file version info

Program on Windows 14 known copies with hashes 13 Sigma rules name it Command wevtutil

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wevtutil.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionEventing Command Line Utility

14 known copies

10.0.22000.65 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wevtutil.exe · signed by Microsoft Windows

438ea50e2fea0b265c441f44f8db18741394e6822461f76b598a2093558b6c5e

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wevtutil.exe · signed by Microsoft Windows

39f3b3133523a9332dd8ee74fd777cf222ed5f7d7adde06993c11ab2a6f4525c

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wevtutil.exe · signed by Microsoft Windows

a7d4d1b2a868df3252fb046126b37c113bab181e805ef7b1e996b7c33983a206

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wevtutil.exe · signed by Microsoft Windows

4a727688b939e08c26064ea08dcff29b3d4608d28820874030524f79b4b1cca8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wevtutil.exe · signed by Microsoft Windows

b2ee960bc90755b5ba89239a50d2311333589fdfc53569b6f57cb43230135add

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wevtutil.exe · signed by Microsoft Windows

f1f16a423959485a949536e61cc63d55879cd7d58f6fd563e918a719b59f8803

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wevtutil.exe · signed by Microsoft Windows

8daad695cd42fe78fd7df497edebc48f56c3cfa1d9025df5580edcd835aef85d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wevtutil.exe · signed by Microsoft Windows

e16b9d201ec1d7e29b3ad532a9ad8f1ae0cb5821bb916a79f6dbeb1c6e6b85fa

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wevtutil.exe · signed by Microsoft Windows

0addeceb61359346c7d752f0fa3d1ce72e8a494cae651a1df2bf1e867e5dfc7c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wevtutil.exe · signed by Microsoft Windows

ccffe548d686eb10fd825171d9c6d1c20aa59e639130ac8a9098776369e77b99

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wevtutil.exe · signed by Microsoft Windows

18a73e6657479d255cae83fabf8b080b7def50f5f5e4d20fefd57d44678bbf48

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wevtutil.exe · signed by Microsoft Windows

dcfd99fe08a5d46c52e810fe2f9cc15ac82008975c0a731a11773b11ade0f3cc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wevtutil.exe · not signed

27a835c4f4c7b44482f991fe82b7163d32fdb4a4b01c9fcf31724789f5017309

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wevtutil.exe · not signed

82484551049f017f4011973e3505b0963b091ac5f503508218caa2f7d34a497f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wevtutil.exe
criticalRorschach Ransomware Execution ActivityX__Junior (Nextron Systems)
highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
highSuspicious Eventlog Clearing or Configuration Change ActivityEcco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highSuspicious Sysmon as Execution ParentFlorian Roth (Nextron Systems), Tim Shelton (fp werfault)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
mediumEventLog Query Requests By Builtin UtilitiesAli Alwashali, Nasreddine Bencherchali (Nextron Systems)
mediumPotential Defense Evasion Via Binary RenameMatthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
mediumPotentially Suspicious EventLog Recon Activity Using Log Query UtilitiesNasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale

Sigma names wevtutil.exe in 13 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.