Library / Windows
taskmgr.exe
Task Manager · Microsoft Corporation
WindowsSysmon-confirmedSigma refs: 5
OriginalFilename
Taskmgr.exe
Casing changed across buildsSome builds lack OriginalFilename
Gotchas
- 2 observed builds carry no OriginalFilename at all.
- Casing differs across builds (
Taskmgr.exe,taskmgr.exe). Case-sensitive comparisons (Elastic KQL on keyword fields,==in KQL/EQL) miss some builds.
Query snippets
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: '\taskmgr.exe'
- OriginalFileName: 'Taskmgr.exe'
condition: selectionprocess_creation logsource. Sigma string matching is case-insensitive.
| tstats summariesonly=false count values(Processes.original_file_name) as original_file_name
from datamodel=Endpoint.Processes
where (Processes.original_file_name="Taskmgr.exe" OR Processes.process_name="taskmgr.exe")
by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.
DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName in~ ("Taskmgr.exe")
or FileName =~ "taskmgr.exe"Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.
process where event.type == "start" and
(process.pe.original_file_name in~ ("Taskmgr.exe") or
process.name : "taskmgr.exe")ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.
['taskmgr.exe'].includes(String(OriginalFileName || '').toLowerCase())Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.
Values across builds
| OriginalFilename | Builds | Arch | File version | Windows releases | Source | Sysmon |
|---|---|---|---|---|---|---|
| Taskmgr.exe | 26 | x64, x86 | 10.0.10240.20747 → 10.0.28000.3086 | Win10 1507 → Win11 26H1 (16) | Host scan, Winbindex | ✓ 2 |
| none | 2 | x64, x86 | 1.0.0.1 | Win10 1607 | Winbindex | |
| taskmgr.exe | 2 | x64 | 10.0.17763.1554 → 10.0.28000.2804 | Win10 1809 → Win11 26H1 (2) | Winbindex |
All 30 parsed builds · 8 Windows release groups not verifiable
| SHA256 | Version | Arch | OriginalFilename | Windows releases | Signature | Source | Sysmon |
|---|---|---|---|---|---|---|---|
| 330180c81428… | 10.0.28000.3086 | x86 | Taskmgr.exe | Win11 26H1 | Winbindex | ||
| 04e2928ff52a… | 10.0.28000.2804 | x64 | taskmgr.exe | Win11 26H1 | Winbindex | ||
| 8215acab6fb1… | 10.0.26100.9549 | x64 | Taskmgr.exe | Win11 24H2 | Signed (Overlay) | Host scan, Winbindex | ✓ |
| 317b35d3e9b2… | 10.0.26100.9549 | x86 | Taskmgr.exe | Win11 24H2 | Signed (Overlay) | Host scan, Winbindex | ✓ |
| e70555457964… | 10.0.17763.1554 | x64 | taskmgr.exe | Win10 1809 | Signed (Overlay) | Winbindex | |
| c2bad053dd1f… | 1.0.0.1 | x86 | none | Win10 1607 | Signed (Overlay) | Winbindex | |
| 7a6b67ab0c36… | 1.0.0.1 | x64 | none | Win10 1607 | Signed (Overlay) | Winbindex | |
| 95bc81aa2708… | 10.0.19041.7548 | x64 | Taskmgr.exe | Win10 21H2 | Signed (Overlay) | Winbindex | |
| 4fdccfb476ab… | 10.0.19041.7548 | x86 | Taskmgr.exe | Win10 21H2 | Signed (Overlay) | Winbindex | |
| 26f020dc1369… | 10.0.19041.6280 | x64 | Taskmgr.exe | Win10 21H2, Win10 22H2 | Signed (Overlay) | Winbindex | |
| a1416fae796a… | 10.0.10240.20747 | x64 | Taskmgr.exe | Win10 1507 | Signed (Overlay) | Winbindex | |
| 1c9098842a93… | 10.0.10240.20747 | x86 | Taskmgr.exe | Win10 1507 | Signed (Overlay) | Winbindex | |
| 9c0f04eb5ca1… | 10.0.26100.5074 | x64 | Taskmgr.exe | Win11 24H2, Win11 25H2 | Signed (Overlay) | Winbindex | |
| 2493a162be9b… | 10.0.26100.5074 | x86 | Taskmgr.exe | Win11 24H2, Win11 25H2 | Signed (Overlay) | Winbindex | |
| 9050b080db4d… | 10.0.19041.6157 | x86 | Taskmgr.exe | Win10 21H2, Win10 22H2 | Signed (Overlay) | Winbindex | |
| 4f5ce43a424f… | 10.0.19041.1202 | x86 | Taskmgr.exe | Win10 2004 … Win10 22H2 (4) | Signed (Overlay) | Winbindex | |
| 4e305198f15b… | 10.0.19041.1202 | x64 | Taskmgr.exe | Win10 2004 … Win10 22H2 (4) | Signed (Overlay) | Winbindex | |
| cf6c3474754b… | 10.0.22000.778 | x86 | Taskmgr.exe | Win11 21H2 | Signed (Overlay) | Winbindex | |
| 86935c2a69aa… | 10.0.17763.1697 | x86 | Taskmgr.exe | Win10 1809 | Signed (Overlay) | Winbindex | |
| 4636ede3b728… | 10.0.19041.844 | x86 | Taskmgr.exe | Win10 2004, Win10 21H1 | Signed (Overlay) | Winbindex | |
| 1f0875f49e31… | 10.0.19041.844 | x64 | Taskmgr.exe | Win10 2004, Win10 21H1 | Signed (Overlay) | Winbindex | |
| 473714cc5f4a… | 10.0.17134.1967 | x86 | Taskmgr.exe | Win10 1803 | Winbindex | ||
| 35105de3ba5b… | 10.0.17134.1967 | x64 | Taskmgr.exe | Win10 1803 | Signed (Overlay) | Winbindex | |
| 733d08b00db7… | 10.0.15063.2614 | x86 | Taskmgr.exe | Win10 1703 | Winbindex | ||
| f7610c1d3eb0… | 10.0.18362.693 | x86 | Taskmgr.exe | Win10 1903 | Signed (Overlay) | Winbindex | |
| 0af6b3f8628e… | 10.0.18362.693 | x64 | Taskmgr.exe | Win10 1903 | Signed (Overlay) | Winbindex | |
| 7c89d443e559… | 10.0.15063.1805 | x64 | Taskmgr.exe | Win10 1703 | Signed (Overlay) | Winbindex | |
| a49842d1a73e… | 10.0.10586.672 | x86 | Taskmgr.exe | Win10 1511 | Signed (Overlay) | Winbindex | |
| 67c120612584… | 10.0.10586.672 | x64 | Taskmgr.exe | Win10 1511 | Signed (Overlay) | Winbindex | |
| 722ea0ef32bd… | 10.0.16299.214 | x86 | Taskmgr.exe | Win10 1709 | Signed (Overlay) | Winbindex |
Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.