CmdID

CmdID / Files

wsmprovhost.exe

Host process for WinRM plug-ins file version info

Program on Windows 16 known copies with hashes 14 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wsmprovhost.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionHost process for WinRM plug-ins

16 known copies

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\system32\wsmprovhost.exe · signed by Microsoft Windows

9067752d40472687362eec031c40208d35a53d5652000e4ef6eb92c5a93a270f

10.0.22000.282 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

be89a0d58492d069421042385a5527673dfb0bc03304a1b1790044f0b9f52733

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\wsmprovhost.exe · signed by Microsoft Windows

0fbb9be7ca2aafde4ed8614a3a9def68e5af1a2cb2e15d6cbcbf7b72f4dcd3b6

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

4fc5d087e446aaa807946a54f99a7ca2083374cfacb87e01bbfe8e76a137d91f

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

519ea677f7f3169121693901de546b3978db63203ab96035c9f3fa50c6ea564a

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\wsmprovhost.exe · signed by Microsoft Windows

f7938766e9bc8363c4a3ac7b1693446849815eca4e34a240f75c9760151a69b3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wsmprovhost.exe · signed by Microsoft Windows

62e620ab5ad80e8e9a9424f776a4f745024591a9f92a7284889e48ebae597342

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

7f04d9fd845a84f948650e15631bea4c923912a4a08c1beff052595b2629ef40

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

7445cfe07ac4e29f8a7393f985f1109fe118e6dacc00f7be245a670b3ce8a592

10.0.18362.693 (WinBuild.160101.0800) · C:\WINDOWS\system32\wsmprovhost.exe · signed by Microsoft Windows

814baeb715c2a74c5ccd5e09de1154a33fed899f8c45b783f254e8963afe0ebf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

36a36855bed0f40d193f8de0035c13c636c6cbd52e4f88759c4858fd0cde08e3

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wsmprovhost.exe · signed by Microsoft Windows

5fccff57d379cdc4cf6196fef554cef753b4c76dc315f371f90aebf07b6a18c3

10.0.14393.3541 (rs1_release_inmarket.200218-2047) · C:\Windows\SysWOW64\wsmprovhost.exe · signed by Microsoft Windows

86965d84501f9c09afe9a74963e8a0ab45b5033936f6c30d3ceec32a4ab6f2be

10.0.14393.3541 (rs1_release_inmarket.200218-2047) · C:\Windows\system32\wsmprovhost.exe · signed by Microsoft Windows

91d6a0097ce3b78b3982cc50c3c2851f6ed66bfc8757f872bb7a76a95dc4af34

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\wsmprovhost.exe · not signed

7edeac6904c1648e6c396b785c88cc9131fcde687f916fd36b012654d425b965

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\wsmprovhost.exe · not signed

f0f1e00ebb34ae2ff99f50fd6e71413bb3ca771adffc0aa0018663d98925512f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wsmprovhost.exe
highSuspicious Processes Spawned by WinRMAndreas Hunkeler (@Karneades), Markus Neis
highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumRemote PowerShell Session Host Process (WinRM)Roberto Rodriguez @Cyb3rWard0g

Sigma names wsmprovhost.exe in 14 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.