CmdID

CmdID / Files

winrshost.exe

Host Process for WinRM's Remote Shell plugin file version info

Program on Windows 12 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real winrshost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHost Process for WinRM's Remote Shell plugin

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\winrshost.exe · signed by Microsoft Windows

13c3dbddb0652120d106d283b1e7b639bb4c43689887e4229e178c612197b4a8

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winrshost.exe · signed by Microsoft Windows

eda7dccefb6620f2b0f104b29889d23733b7a2b8e4bc6b228e02e74db126b005

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\winrshost.exe · signed by Microsoft Windows

047427e1ecc1d5758a9553f0e819a9536d9d56d279ba81f707fe377fa1433318

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winrshost.exe · signed by Microsoft Windows

233e8ea78906fb63e306dd5ffdbe07716daa9144a2b4715b0ef9c2c990ef60c0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\winrshost.exe · signed by Microsoft Windows

c544ea4a01f1bc674d6f1a47a8d2de6e6f849c069373ef71084c8fdb13de5c8c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\winrshost.exe · signed by Microsoft Windows

c9a3a8c9b90fc0418473af62a19423bb726e1af0cfaaa1d9df132dc6605de178

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\winrshost.exe · signed by Microsoft Windows

401441db1dbe8189eb5cf230714d8271f10f1023e893901c6db95e6325b46884

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\winrshost.exe · signed by Microsoft Windows

9572884598bdb3c1a4b7d2e0e1b6945ed62f4172221e468ef53aa5a25e809691

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\winrshost.exe · signed by Microsoft Windows

607c014a3ca531ffad50bcd90095c01e4e6b691d9e18473c70e4699cf1e31453

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\winrshost.exe · signed by Microsoft Windows

d3163d97dae33ccf4b845416c13df6fea0650a4d1cea1334ea212accdf7732fb

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\winrshost.exe · not signed

8142a15194183bab9fe1967abd0961d633d6030d3753099a67150f9c4ab6d4fb

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\winrshost.exe · not signed

bb39024c490bd804bab068ac14cf7cbabba1c2e7e3dfeb495d23b549955cebd1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name winrshost.exe
mediumPotential Lateral Movement via Windows Remote ShellLiran Ravich

Sigma names winrshost.exe in 3 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.