public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-28 15:58:24 +01:00
Code Issues Projects Releases Wiki Activity

Add Diantz directives/DDF entry to diantz.exe (#390)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
TAbdiukov 2024-08-18 07:02:55 +10:00 committed by GitHub
parent e1d0707082
commit e09cf1066f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
yml/OSBinaries/Diantz.yml
View File

@ -1,7 +1,7 @@
--- ---
Name: Diantz.exe Name: Diantz.exe
Description: Binary that package existing files into a cabinet (.cab) file Description: Binary that package existing files into a cabinet (.cab) file
Author: 'Tamir Yehuda' Author: Tamir Yehuda
Created: 2020-08-08 Created: 2020-08-08
Commands: Commands:
- Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab - Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
@ -22,6 +22,15 @@ Commands:
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019 OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Tags: Tags:
- Type: Compression - Type: Compression
- Command: diantz /f directives.ddf
Description: Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
Usecase: Bypass command-line based detections
Category: Execute
Privileges: User
MitreID: T1036
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Tags:
- Type: Compression
Full_Path: Full_Path:
- Path: c:\windows\system32\diantz.exe - Path: c:\windows\system32\diantz.exe
- Path: c:\windows\syswow64\diantz.exe - Path: c:\windows\syswow64\diantz.exe
@ -34,6 +43,7 @@ Detection:
- IOC: diantz getting a file from a remote machine or the internet. - IOC: diantz getting a file from a remote machine or the internet.
Resources: Resources:
- Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz - Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz
- Link: https://ss64.com/nt/makecab-directives.html
Acknowledgement: Acknowledgement:
- Person: Tamir Yehuda - Person: Tamir Yehuda
Handle: '@tim8288' Handle: '@tim8288'