ComputerDefaults.exe

Upon execution, ComputerDefaults.exe checks two registry values at HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command; if these are set by an attacker, the set command will be executed as a high-integrity process without a UAC prompt being displayed to the user. See 'resources' for which registry keys/values to set.

Use Execute a binary or script as a high-integrity process without a UAC prompt.

ComputerDefaults.exe

Context

user

Native

UAC Bypass

MITRE

T1548.002

Detection

IOC: Event ID 10

IOC: A binary or script spawned as a child process of ComputerDefaults.exe

IOC: Changes to HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command

Sigma: github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml

Refs

gist.github.com/havoc3-3/812547525107bd138a1a839118a3a44b

lolbas-project.github.io/lolbas/Binaries/ComputerDefaults/