MpCmdRun.exe
Sources: 300M+ executions observed in the wild.
Summary
Microsoft Malware Protection Command Line Utility (MpCmdRun.exe) is the command-line interface for Windows Defender / Microsoft Defender Antivirus. It can perform scans, update definitions, manage quarantine, collect diagnostic data, and restore quarantined files.
MpCmdRun.exe is the 77th most commonly executed Windows program in EchoTrail's dataset, observed 353,870 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by svchost.exe.
Get this in your tools
The same record for mpcmdrun.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/mpcmdrun.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\ProgramData\...84.03%
- C:\Program Files\Windows Defender15.9%
- C:\Program Files\Microsoft Security Client0.07%
Top Hashes (SHA256)
- 932e2c18ab6cc80fd998d3229397f1db13c253af7e5f236126a9d6b93419637b6.9%
- 4b0f0528e0bc3167af8e03fc6fb970d5ed9cf373ba8e3c23d0d8a9b453d0be9a6.87%
- 60d88450bc4d6e9bcb83fbcd0342376694dc55eb8f40b0f79580d1df399a7bdf5.13%
- afb9bc4bde1632b3012fbb26b989943d9e8031ef2ce903e3a5bbe1f8db01b27d4.17%
- df8b859d4ba62fcc97636e73ade83b30ed572e92fe5a98e09b95f1e27da1c4153.59%
- 99f3e087418856564b64ee52ffa2e293669c1eaba849c82d77692d81f41623ed2.87%
- 10bf0f88125de048862b0eb2185f3dd4604b5ed3bc3538f8e59892f6ac344f102.61%
- 4b9ace449fc8e4a666fd7e1b650d22ec85a0dc405ddf4ba58a2b938c00cb896c2.53%
- e3ac7a2deeb3c633be6cff74b68085c665d1e9b67c133efb3ca6673cfef0e6fc2.51%
- b6006f54223b8aff3ffc26f3d78df002c1a3fcf11e43601d5f6edd94ce95f27e2.42%
Process Ancestry
Top Grandparents
- services.exe89.39%
- MsMpEng.exe9.86%
- svchost.exe0.57%
- wininit.exe0.13%
- LTSVC.exe0.04%
- SophosFileScanner.exe<0.01%
- srvany.exe<0.01%
Top Parents
- svchost.exe44.55%
- MsMpEng.exe43%
- MpCmdRun.exe10.91%
- cmd.exe0.09%
- services.exe0.06%
- SophosFileScanner.exe<0.01%
Top Children
- conhost.exe79.66%
- MpCmdRun.exe19.79%
Security Analysis
What does MpCmdRun.exe normally do?
Located in C:\ProgramData\Microsoft\Windows Defender\Platform\<version> or C:\Program Files\Windows Defender. Launched by svchost.exe (scheduled scans), MsMpEng.exe (Defender engine), or self-spawned. Spawns conhost.exe.
When is MpCmdRun.exe suspicious?
Using -DownloadFile to download files from URLs — this is a known LOLBin technique. Using -RemoveDefinitions to disable Defender signatures. Restoring quarantined malware files. Running from an unexpected path.
How do attackers abuse MpCmdRun.exe?
File download: MpCmdRun.exe -DownloadFile -url <URL> -path <output> can download arbitrary files using a signed Microsoft binary, bypassing some download controls. Definition removal: MpCmdRun.exe -RemoveDefinitions -all disables all Defender signatures. Quarantine restoration: restoring quarantined malicious files for re-execution.
Detection guidance
High-confidence: MpCmdRun.exe with -DownloadFile flag. MpCmdRun.exe with -RemoveDefinitions. Medium-confidence: MpCmdRun.exe launched by unusual parents (not svchost.exe or MsMpEng.exe). Quarantine restore operations outside of incident response context.
False positive notes
Very common during Defender scan and update operations. Self-spawning for definition updates is normal. IT administrators may use MpCmdRun for legitimate Defender management.
Related Processes
Ask Rocky about MpCmdRun.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for MpCmdRun.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.