CmdID

CmdID / Files

WUDFHost.exe

Windows Driver Foundation - User-mode Driver Framework Host Process file version info

Program on Windows 6 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WUDFHost.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Driver Foundation - User-mode Driver Framework Host Process

6 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WUDFHost.exe · signed by Microsoft Windows

3b6dcd23432b4c9a74b7905d4713f33c5e1162436b3a8e94ef0347a1a3107c56

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WUDFHost.exe · signed by Microsoft Windows

e6f5de8bc3fc572d9a2866024c5af3a83a4d70f4d38810b9e7679a2e9f89775c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WUDFHost.exe · signed by Microsoft Windows

8fe1e68d6ea8c270e81ee2ac71fcae54be037875977995d6793629b175d9cb8d

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WUDFHost.exe · signed by Microsoft Windows

2e9edac8ad372bd9adffe852a18f5fbd25de804c0ca39c2f5b88365cc443c138

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WUDFHost.exe · signed by Microsoft Windows

305b523064835550ff226f6a3ff2ddcd2b43403e437566b0686b22e6568ba02e

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\WUDFHost.exe · not signed

8e5a9e595f24d07206791817972fe475a0d66f3abb9cfddc8fb50203ad449dae

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name WUDFHost.exe
mediumUnusual Parent Process For Cmd.EXETim Rauch, Elastic (idea)

Sigma names WUDFHost.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.