MpCmdRun.exe
Summary
Microsoft Malware Protection Command Line Utility (MpCmdRun.exe) is the command-line interface for Windows Defender / Microsoft Defender Antivirus. It can perform scans, update definitions, manage quarantine, collect diagnostic data, and restore quarantined files.
MpCmdRun.exe is the 77th most commonly executed Windows program in EchoTrail's dataset, observed 353,870 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\ProgramData\...84.03%
- C:\Program Files\Windows Defender15.9%
- C:\Program Files\Microsoft Security Client0.07%
Top Hashes (SHA256)
- 932e2c18ab6cc80fd998d3229397f1db13c253af7e5f236126a9d6b93419637b6.9%
- 4b0f0528e0bc3167af8e03fc6fb970d5ed9cf373ba8e3c23d0d8a9b453d0be9a6.87%
- 60d88450bc4d6e9bcb83fbcd0342376694dc55eb8f40b0f79580d1df399a7bdf5.13%
- afb9bc4bde1632b3012fbb26b989943d9e8031ef2ce903e3a5bbe1f8db01b27d4.17%
- df8b859d4ba62fcc97636e73ade83b30ed572e92fe5a98e09b95f1e27da1c4153.59%
- 99f3e087418856564b64ee52ffa2e293669c1eaba849c82d77692d81f41623ed2.87%
- 10bf0f88125de048862b0eb2185f3dd4604b5ed3bc3538f8e59892f6ac344f102.61%
- 4b9ace449fc8e4a666fd7e1b650d22ec85a0dc405ddf4ba58a2b938c00cb896c2.53%
- e3ac7a2deeb3c633be6cff74b68085c665d1e9b67c133efb3ca6673cfef0e6fc2.51%
- b6006f54223b8aff3ffc26f3d78df002c1a3fcf11e43601d5f6edd94ce95f27e2.42%
Process Ancestry
Top Grandparents
- services.exe89.39%
- MsMpEng.exe9.86%
- svchost.exe0.57%
- wininit.exe0.13%
- LTSVC.exe0.04%
- SophosFileScanner.exe<0.01%
- srvany.exe<0.01%
Top Parents
- svchost.exe44.55%
- MsMpEng.exe43%
- MpCmdRun.exe10.91%
- cmd.exe0.09%
- services.exe0.06%
- SophosFileScanner.exe<0.01%
Top Children
- conhost.exe79.66%
- MpCmdRun.exe19.79%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does MpCmdRun.exe normally do?
Located in C:\ProgramData\Microsoft\Windows Defender\Platform\<version> or C:\Program Files\Windows Defender. Launched by svchost.exe (scheduled scans), MsMpEng.exe (Defender engine), or self-spawned. Spawns conhost.exe.
When is MpCmdRun.exe suspicious?
Using -DownloadFile to download files from URLs — this is a known LOLBin technique. Using -RemoveDefinitions to disable Defender signatures. Restoring quarantined malware files. Running from an unexpected path.
How do attackers abuse MpCmdRun.exe?
File download: MpCmdRun.exe -DownloadFile -url <URL> -path <output> can download arbitrary files using a signed Microsoft binary, bypassing some download controls. Definition removal: MpCmdRun.exe -RemoveDefinitions -all disables all Defender signatures. Quarantine restoration: restoring quarantined malicious files for re-execution.
Detection guidance
High-confidence: MpCmdRun.exe with -DownloadFile flag. MpCmdRun.exe with -RemoveDefinitions. Medium-confidence: MpCmdRun.exe launched by unusual parents (not svchost.exe or MsMpEng.exe). Quarantine restore operations outside of incident response context.
False positive notes
Very common during Defender scan and update operations. Self-spawning for definition updates is normal. IT administrators may use MpCmdRun for legitimate Defender management.
Related Processes
Ask Rocky about MpCmdRun.exe
Rocky answers questions about MpCmdRun.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.