LOL · OtherMSBinary

DefaultPack.EXE

1 techniqueWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Use DefaultPack.EXE to execute arbitrary binaries, with added argument support.

Use Can be used to execute stagers, binaries, and other malicious commands.

DefaultPack.EXE /C:"{CMD}"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218
Detection: Sigma: github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_lolbin_defaultpack.yml
IOC: DefaultPack.EXE spawned an unknown process
Refs: twitter.com/checkymander/status/1311509470275604480.
lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/