Is sdbinst.exe malware if it is using options not listed in MS documentation?

SLM64 20 Reputation points
2024-06-01T22:12:02.1766667+00:00

I am using Sysmon and sending the logs to Wazuh for threat detection. It shows a level 12 event that pertains to sdbinst.exe. The event data command line was C:\WINDOWS\System32\sdbinst.exe -m -bg but according to MS documentation the options used by the .exe are not allowable.

See https://learn.microsoft.com/en-us/windows/deployment/planning/using-the-sdbinstexe-command-line-tool

Does this mean the the exe is malicious?

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,170 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.