stordiag.exe

LOLBAS Execute 1 ATT&CK technique 2 documented commands 9 known copies with hashes

How stordiag.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for stordiag.exe.

2 documented commands

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

Once executed, Stordiag.exe will execute schtasks.exe systeminfo.exe and fltmc.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it.

stordiag.exe

Identify

Execute T1218 System Binary Proxy Execution User privileges

Once executed, Stordiag.exe will execute schtasks.exe and powershell.exe - if stordiag.exe is copied to a folder and an arbitrary executable is renamed to one of these names, stordiag.exe will execute it.

stordiag.exe

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for stordiag.exe, by Eral4m, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for stordiag.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1218System Binary Proxy Execution

Is it the real stordiag.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft (R) Windows (R) Operating System, Microsoft Corporation

9 known copies

10.0.22000.1 · C:\WINDOWS\system32\stordiag.exe · signed by Microsoft Windows

caebdba030a9458f6ecb452faf79a6a3e19a666e16471f12ac26017714cb1a2a

10.0.22000.1 · C:\WINDOWS\SysWOW64\stordiag.exe · signed by Microsoft Windows

cd78de48741008e6141c4bb2f4ab8fd0b4640eadd95b2d637ca0acbc084ea8f2

10.0.19041.1 · C:\Windows\system32\stordiag.exe · signed by Microsoft Windows

6a13dac8bd42767dad55d4c1ed4640f4e7f01abb08ca05ddcdc2c348fcd6f8b3

10.0.19041.1 · C:\Windows\SysWOW64\stordiag.exe · signed by Microsoft Windows

b812162f140a347ec78756416302cbc9204ef484feb7623c0fff8ff7b4b3ec04

10.0.18362.1 · C:\WINDOWS\SysWOW64\stordiag.exe · signed by Microsoft Windows

04785b45f5e89cf98a45f917948826b63d2f9bc155d291544626f5b8b9c01318

10.0.18362.1 · C:\WINDOWS\system32\stordiag.exe · signed by Microsoft Windows

3bc839b933d9c40a8b8d25b415c1037ba4a47009bf3c4e3a3d4c26554b7d4898

10.0.17763.1 · C:\Windows\SysWOW64\stordiag.exe · signed by Microsoft Windows

d706dc037c51b48e412e6ca00129fc34f06830c27260a5d84f7d30d61237e980

10.0.17763.1 · C:\Windows\system32\stordiag.exe · signed by Microsoft Windows

ddc1c81667a942f91f25e18eaf3afc453f7fe3a4cc4140cba82fb49732011536

10.0.14393.0 · C:\Windows\system32\stordiag.exe · signed by Microsoft Windows

75cbe3cc080a0c681e925e8a7fa20577524e04e0d7e713dd0e73355ed02af960

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.