This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider. Located at: C:\Program Files (x86)\Microsoft\DefaultPack\DefaultPack.exe.
defaultpackdefaultpackSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Use DefaultPack.EXE to execute arbitrary binaries, with added argument support. (Can be used to execute stagers, binaries, and other malicious commands.)
DefaultPack.EXE /C:"{CMD}"| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_lolbin_defaultpack.yml |
| ioc | DefaultPack.EXE spawned an unknown process |
defaultpack is a Windows LOLBin. This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider. Located at: C:\Program Files (x86)\Microsoft\DefaultPack\DefaultPack.exe.