Uncommon Child Process Of Defaultpack.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects when 'DefaultPack.exe' launches any child process. 'DefaultPack.exe' is a legitimate Microsoft binary that can be abused by adversaries to proxy execution of other programs, often for defense evasion. The rule aims to identify suspicious activity where this binary is used to launch unexpected or malicious child processes.