LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

ComputerDefaults.exe

View source

ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.

UAC Bypass
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

UAC Bypass1

EXAMPLE 01T1548.002

Upon execution, ComputerDefaults.exe checks two registry values at HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command; if these are set by an attacker, the set command will be executed as a high-integrity process without a UAC prompt being displayed to the user. See 'resources' for which registry keys/values to set.

COMMAND
ComputerDefaults.exe
USE CASE
Execute a binary or script as a high-integrity process without a UAC prompt.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\ComputerDefaults.exe
C:\Windows\SysWOW64\ComputerDefaults.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Event ID 10

  • IOC

    A binary or script spawned as a child process of ComputerDefaults.exe

  • IOC

    Changes to HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Eron Clarke