Library / Windows

windows.media.backgroundplayback.exe

Windows Media Playback EXE · Microsoft Corporation

WindowsSysmon-confirmed

OriginalFilename

Windows.Media.Playback.exe

Differs from file name

Gotchas

OriginalFilename doesn't match the file name: a rule using OriginalFileName: windows.media.backgroundplayback.exe never fires.

Query snippets

logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: '\windows.media.backgroundplayback.exe'
    - OriginalFileName: 'Windows.Media.Playback.exe'
  condition: selection

process_creation logsource. Sigma string matching is case-insensitive.

| tstats summariesonly=false count values(Processes.original_file_name) as original_file_name
    from datamodel=Endpoint.Processes
    where (Processes.original_file_name="Windows.Media.Playback.exe" OR Processes.process_name="windows.media.backgroundplayback.exe")
    by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *

Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName in~ ("Windows.Media.Playback.exe")
    or FileName =~ "windows.media.backgroundplayback.exe"

Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.

process where event.type == "start" and
  (process.pe.original_file_name in~ ("Windows.Media.Playback.exe") or
   process.name : "windows.media.backgroundplayback.exe")

ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.

['windows.media.playback.exe'].includes(String(OriginalFileName || '').toLowerCase())

Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.

Values across builds

OriginalFilename	Builds	Arch	File version	Windows releases	Source	Sysmon
Windows.Media.Playback.exe	2	x64, x86	10.0.26100.1 → 10.0.26100.1150		Host scan	✓ 2

OriginalFilename

Builds

Arch

File version

Windows releases

Source

Sysmon

Windows.Media.Playback.exe

x64, x86

10.0.26100.1 → 10.0.26100.1150

Host scan

✓ 2

InternalName: Windows Media Playback EXE · Product: Microsoft® Windows® Operating System

All 2 parsed builds

SHA256	Version	Arch	OriginalFilename	Windows releases	Signature	Source	Sysmon
fc523163e02e…	10.0.26100.1150	x64	Windows.Media.Playback.exe			Host scan	✓
6dfb7b5170f9…	10.0.26100.1	x86	Windows.Media.Playback.exe			Host scan	✓

SHA256

Version

Arch

OriginalFilename

Windows releases

Signature

Source

Sysmon

fc523163e02e…

10.0.26100.1150

x64

Windows.Media.Playback.exe

Host scan

✓

6dfb7b5170f9…

10.0.26100.1

x86

Windows.Media.Playback.exe

Host scan

✓

Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.