mirror of
https://github.com/LOLBAS-Project/LOLBAS
synced 2025-01-30 23:33:04 +01:00
50 lines
2.2 KiB
YAML
50 lines
2.2 KiB
YAML
---
|
|
Name: Diantz.exe
|
|
Description: Binary that package existing files into a cabinet (.cab) file
|
|
Author: Tamir Yehuda
|
|
Created: 2020-08-08
|
|
Commands:
|
|
- Command: diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab
|
|
Description: Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
|
|
Usecase: Hide data compressed into an Alternate Data Stream.
|
|
Category: ADS
|
|
Privileges: User
|
|
MitreID: T1564.004
|
|
OperatingSystem: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
|
|
Tags:
|
|
- Type: Compression
|
|
- Command: diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
|
|
Description: Download and compress a remote file and store it in a CAB file on local machine.
|
|
Usecase: Download and compress into a cab file.
|
|
Category: Download
|
|
Privileges: User
|
|
MitreID: T1105
|
|
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
|
|
Tags:
|
|
- Type: Compression
|
|
- Command: diantz /f {PATH:.ddf}
|
|
Description: Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
|
|
Usecase: Bypass command-line based detections
|
|
Category: Execute
|
|
Privileges: User
|
|
MitreID: T1036
|
|
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
|
|
Tags:
|
|
- Type: Compression
|
|
Full_Path:
|
|
- Path: c:\windows\system32\diantz.exe
|
|
- Path: c:\windows\syswow64\diantz.exe
|
|
Detection:
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml
|
|
- Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml
|
|
- IOC: diantz storing data into alternate data streams.
|
|
- IOC: diantz getting a file from a remote machine or the internet.
|
|
Resources:
|
|
- Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz
|
|
- Link: https://ss64.com/nt/makecab-directives.html
|
|
Acknowledgement:
|
|
- Person: Tamir Yehuda
|
|
Handle: '@tim8288'
|
|
- Person: Hai Vaknin
|
|
Handle: '@vakninhai'
|