computerdefaults.exe

Set Program Access and Computer Defaults Control Panel file version info (xCyclopedia)

LOLBAS UAC Bypass 1 Sigma rule name it 1 ATT&CK technique 1 documented command 12 known copies with hashes

How computerdefaults.exe is abused

documented by LOLBAS

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for computerdefaults.exe.

1 documented command

from LOLBAS, each read by the identifier

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control User privileges

Upon execution, ComputerDefaults.exe checks two registry values at HKEY_CURRENT_USER\Software\Classes\ms-settings\Shell\open\command; if these are set by an attacker, the set command will be executed as a high-integrity process without a UAC prompt being displayed to the user. See 'resources' for which registry keys/values to set.

ComputerDefaults.exe

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for computerdefaults.exe, by Eron Clarke, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for computerdefaults.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highUAC Bypass Tools Using ComputerDefaultsChristian Burkard (Nextron Systems)

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real computerdefaults.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionSet Program Access and Computer Defaults Control Panel

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ComputerDefaults.exe · signed by Microsoft Windows

a2794be7cb7a4ad2f526fe91ca95a36b2ec1648b288088eaa4809402c7b2c6f4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ComputerDefaults.exe · signed by Microsoft Windows

fdad0ce82ad32734c00dd26ae6705076c4432b74f77f0c8832a93eb470598e63

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ComputerDefaults.exe · signed by Microsoft Windows

4c70fea1c4f9b78955eb840c11c6c81f1d860485e090526a8e8176d98b1be3d6

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\ComputerDefaults.exe · signed by Microsoft Windows

7b0334c329e40a542681bcaff610ae58ada8b1f77ff6477734c1b8b9a951ef4c

10.0.18362.267 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\ComputerDefaults.exe · signed by Microsoft Windows

58ba527a7734600f3ff475a38a0cb233a883eff4f09dffe2b23686c9c8253f35

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\ComputerDefaults.exe · signed by Microsoft Windows

64959878420834ffdf17823f1cc507261f1cef286ff476777c4f3da7d17afa24

10.0.17763.1075 (WinBuild.160101.0800) · C:\Windows\SysWOW64\ComputerDefaults.exe · signed by Microsoft Windows

88a550361c783fe8c807882462a0cc988fea24426abf5aa3ab9fd5a300dd296a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\ComputerDefaults.exe · signed by Microsoft Windows

b2c06a97827f403848620caae012c284604b5093ed7950ac4ead2b9ee4d28eb3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\ComputerDefaults.exe · signed by Microsoft Windows

4978ad7650c44d4239ed6b77267dd21d50d33bbd3d875ace4131f2ded3a11804

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\ComputerDefaults.exe · signed by Microsoft Windows

56b15c941cdbb2e28654b21fc3b6ed8ca75b322b9f86ddec681dda7cc032da4f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\ComputerDefaults.exe · not signed

2990059766f4118256b48decfe2d586d469a219c1e5dda038943c97bbfaa661d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\ComputerDefaults.exe · not signed

b288ff09ebfb68bb2375f6f60b2e47e85e3813debda6e01411d7aaca5bf01b9c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.