DefaultPack.exe process execution monitoring
DefaultPack.exe is a legitimate Windows binary that can be abused as a LOLBAS proxy to execute arbitrary child processes.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:36 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
DefaultPack.exe is a legitimate Windows component that can be leveraged by attackers to proxy the execution of other binaries. Monitoring for child processes spawned by this executable is an effective way to identify potential living-off-the-land (LotL) execution attempts.
Recommendation
Deploy the provided Sigma rule to detect and audit child processes spawned by DefaultPack.exe. Given the lack of a known baseline for legitimate child processes in all environments, monitor this activity to establish an allowlist of permitted execution paths before moving to blocking mode.
Threat Hunt
Baseline all child processes spawned by DefaultPack.exe to identify legitimate usage.
Data: Process creation logs (ParentImage and Image fields)
Detection coverage 1
Detect DefaultPack.exe Child Process
mediumDetects the execution of any child process spawned by DefaultPack.exe
Detection queries are available on the platform. Get full rules →