CmdID

CmdID / Files

wlanext.exe

Windows Wireless LAN 802.11 Extensibility Framework file version info

Program on Windows 6 known copies with hashes 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wlanext.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Wireless LAN 802.11 Extensibility Framework

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wlanext.exe · signed by Microsoft Windows

15e02869b1c820c3f67145902d8a53c483edca1b5564b3d68fb278ba5dfa9595

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wlanext.exe · signed by Microsoft Windows

f7596065864b49dba802e5b909c63bd448e34281a82301a2f4ff535fbc710573

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wlanext.exe · signed by Microsoft Windows

3c928b9aff2e651aa35ea798c29fde398e9f7817e3451ae0f4c97c86630dc92b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wlanext.exe · signed by Microsoft Windows

8456099deb994f309fde890e4f0e571a0a67f9b7dd079516905175cd1500fa52

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wlanext.exe · signed by Microsoft Windows

d70707b830b7a0a4683ca2169328131a385da0f859b96704653d59c6afae04ad

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wlanext.exe · signed by Microsoft Windows

eea910712ed819ab42d80833df0b0666de6d8971a03a791fc4d598aec75efa70

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wlanext.exe
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names wlanext.exe in 3 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.