huntrule

Windows: Uncommon Child Process Spawned by DefaultPack.exe

Alerts when DefaultPack.exe spawns an uncommon child process, indicating potential proxy execution on Windows.

FreeUnreviewedSigmamediumv1
title: "Windows: Uncommon Child Process Spawned by DefaultPack.exe"
id: 25fc16d6-e015-453f-b614-72080b7d99f3
status: test
description: This rule flags process creation events where the parent process ends with DefaultPack.exe and it spawns a child process that is not typical for that parent. Attackers can abuse legitimate binaries to proxy execution and launch additional tooling while blending into normal activity. It relies on Windows process creation telemetry that records parent and child image paths.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/
  - https://www.echotrail.io/insights/search/defaultpack.exe
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml
author: frack113, Huntrule Team
date: 2022-12-31
modified: 2024-04-22
tags:
  - attack.stealth
  - attack.t1218
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \DefaultPack.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b2309017-4235-44fe-b5af-b15363011957
    type: derived

What it detects

This rule flags process creation events where the parent process ends with DefaultPack.exe and it spawns a child process that is not typical for that parent. Attackers can abuse legitimate binaries to proxy execution and launch additional tooling while blending into normal activity. It relies on Windows process creation telemetry that records parent and child image paths.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.