ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback. Located at: C:\Windows\System32\ComputerDefaults.exe; C:\Windows\SysWOW64\ComputerDefaults.exe.
computerdefaultscomputerdefaultsSandbox: execFile · Timeout: 30s
security.privilege-escalation.uac-bypass Outputs
process.output Command execution output
privilege_escalationprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Upon execution, ComputerDefaults.exe checks two registry values at HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command; if these are set by an attacker, the set command will be executed as a high-integrity process without a UAC prompt being displayed to the user. See 'resources' for which registry keys/values to set. (Execute a binary or script as a high-integrity process without a UAC prompt.)
ComputerDefaults.exe| Type | Rule / Indicator |
|---|---|
| ioc | Event ID 10 |
| ioc | A binary or script spawned as a child process of ComputerDefaults.exe |
| ioc | Changes to HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml |
computerdefaults is a Windows LOLBin. ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback. Located at: C:\Windows\System32\ComputerDefaults.exe; C:\Windows\SysWOW64\ComputerDefaults.exe.