LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

DefaultPack.EXE

View source

This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Use DefaultPack.EXE to execute arbitrary binaries, with added argument support.

COMMAND
DefaultPack.EXE /C:"{CMD}"
USE CASE
Can be used to execute stagers, binaries, and other malicious commands.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · CMD
02 / ON DISK

Known paths

C:\Program Files (x86)\Microsoft\DefaultPack\DefaultPack.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    DefaultPack.EXE spawned an unknown process

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

checkymander@checkymander