DefaultPack.EXE

type: OtherMSBinaries

This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.

Full path

C:\Program Files (x86)\Microsoft\DefaultPack\DefaultPack.exe

Commands

ExecuteUser T1218
Can be used to execute stagers, binaries, and other malicious commands.
```
DefaultPack.EXE /C:"{CMD}"
```
Use DefaultPack.EXE to execute arbitrary binaries, with added argument support.
os: Windows
Execute: CMD

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_lolbin_defaultpack.yml
IOCDefaultPack.EXE spawned an unknown process

Resources

https://twitter.com/checkymander/status/1311509470275604480.

acknowledgement: checkymander @checkymander