sdclt.exe
Sources: 300M+ executions observed in the wild.
Summary
Windows Backup and Restore control panel applet - manages Windows backup settings and restore operations.
sdclt.exe is the 1129th most commonly executed Windows program in EchoTrail's dataset, observed 1,525 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by services.exe.
Get this in your tools
The same record for sdclt.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/sdclt.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 61bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd100%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Security Analysis
What does sdclt.exe normally do?
Launched from Control Panel or Settings to configure Windows Backup. Auto-elevates without a UAC prompt on some Windows versions.
When is sdclt.exe suspicious?
Spawning unexpected child processes. Being used as a UAC bypass vector. Running from command line rather than GUI.
How do attackers abuse sdclt.exe?
sdclt.exe auto-elevates on Windows 10 and can be exploited for UAC bypass. Attackers modify the HKCU registry to hijack the elevated process and execute arbitrary commands with high integrity. Multiple UAC bypass techniques documented.
Detection guidance
Monitor for sdclt.exe spawning unexpected child processes (cmd.exe, powershell.exe). Alert on registry modifications to HKCU\Software\Classes\exefile\shell or related keys before sdclt.exe execution.
False positive notes
Legitimate when users access Backup and Restore from Control Panel.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about sdclt.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for sdclt.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.