CmdID

CmdID / Files

winlogon.exe

Windows Logon Application file version info

Program on Windows 9 known copies with hashes 13 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winlogon.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Logon Application

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winlogon.exe · signed by Microsoft Windows

b46fabe1490f8cf4fc3996d4bf8799c175f3027fccb4285057dc72e1169cf1f7

10.0.19041.1151 (WinBuild.160101.0800) · C:\Windows\system32\winlogon.exe · signed by Microsoft Windows

26db419399e1df308fc195821858b322146867ca637bc717f3982f8b0dba6db4

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winlogon.exe · signed by Microsoft Windows

1a1fe677953a31886243f5410fa08fbd12f6022cc952f6712542bed02259779c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winlogon.exe · signed by Microsoft Windows

a4d74c4a92007e3d6b893187f67dea65c15a0a551e1f8956685d115a3f202958

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winlogon.exe · signed by Microsoft Windows

fbc2eb97a177f7cbd6e38f3a6c45471e988b01978724f9790af0377bb5f3bf8d

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winlogon.exe · signed by Microsoft Windows

6cf2dd482973ac4cf05a784b7bbc08de07fb4a55a8e2a6390250019a800d5b72

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\winlogon.exe · signed by Microsoft Windows

290c8c4b387b669b3988938d0083aa4b210365fb0855eae010f49062a9ddeb04

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\winlogon.exe · signed by Microsoft Windows

f002f8c2ea49d21f242996e3d57f5fdd7995fe6db524bb69bbd7f190cc0211a9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\winlogon.exe · not signed

38d1695f08ec655945ca7a40e7d9485696ffa0bfb7dc809e4cbdba09ea160bc9

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name winlogon.exe
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
highTerminal Service Process SpawnFlorian Roth (Nextron Systems)
mediumConhost Spawned By Uncommon Parent ProcessTim Rauch, Elastic (idea)
mediumWlrmdr.EXE Uncommon Argument Or Child Processfrack113, manasmbellani
lowWindows Processes Suspicious Parent Directoryvburov

Sigma names winlogon.exe in 13 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.