presentationhost.exe

Windows Presentation Foundation Host file version info (xCyclopedia)

LOLBAS Execute, Download 2 Sigma rules name it 2 ATT&CK techniques 2 documented commands 12 known copies with hashes

How presentationhost.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Download T1105 Ingress Tool Transfer

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for presentationhost.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Executes the target XAML Browser Application (XBAP) file

Presentationhost.exe {PATH_ABSOLUTE:.xbap}

Identify

Trips 1 Sigma rule: mediumXBAP Execution From Uncommon Locations Via PresentationHost.EXE by Nasreddine Bencherchali (Nextron Systems)

Download T1105 Ingress Tool Transfer User privileges

It will download a remote payload and place it in INetCache.

Presentationhost.exe {REMOTEURL}

Identify

Trips 1 Sigma rule: mediumArbitrary File Download Via PresentationHost.EXE by Nasreddine Bencherchali (Nextron Systems)

All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for presentationhost.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for presentationhost.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

mediumArbitrary File Download Via PresentationHost.EXENasreddine Bencherchali (Nextron Systems)

mediumXBAP Execution From Uncommon Locations Via PresentationHost.EXENasreddine Bencherchali (Nextron Systems)

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

Is it the real presentationhost.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows Presentation Foundation Host

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\PresentationHost.exe · signed by Microsoft Windows

b8ee4521152b66da6a8adb270d214df7808ac75cedbc81149ede4f5fafe8bf74

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\PresentationHost.exe · signed by Microsoft Windows

bb432c938c36f4127ec91b074cd88d4aad73ef3947e542db8295b04052c75d0c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\PresentationHost.exe · signed by Microsoft Windows

17d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PresentationHost.exe · signed by Microsoft Windows

d9c533b6109160abbf139d83c438806563e212d5c877192b64e4304806626c0a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\PresentationHost.exe · signed by Microsoft Windows

6a51d20b0d5e3889a5bf168bf6c9a81ae50ccf74c5349547146f11c6016a87db

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\PresentationHost.exe · signed by Microsoft Windows

b3982e67820abc7b41818a7236232ce6de92689b76b6f152fab9ef302528566d

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\PresentationHost.exe · signed by Microsoft Windows

54be944eb17bc7deb3618c7844580bdf74308a1f07de10004ceb4a8ecce2b367

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\PresentationHost.exe · signed by Microsoft Windows

ef0751761e476e3233666bacb2839ebdc54abc962841cd92dd87358351402a40

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\PresentationHost.exe · not signed

596deac6b7ad125654c102d092f4c2c94a280a0ccb0aa4c7b00679d6cdfbe50d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\PresentationHost.exe · not signed

9b87765286fc691e8b8ffdc3b28355d21cf37eb3532098c9798c108cfdf63d50

4.0.41210.0 built by: Main · C:\WINDOWS\SysWOW64\PresentationHost.exe · signed by Microsoft Windows

e85ec38b9b042fd8d9a250a21e62a0f0adf2b1d5b8eff281e84522307f0f9b39

4.0.41210.0 built by: Main · C:\WINDOWS\system32\PresentationHost.exe · signed by Microsoft Windows

fed3eb0690fbf5702fb8f737f81e7f73e5649f0fe692bd4649f03dfac81f07ad

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.