Diantz.exe

Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

Use Hide data compressed into an Alternate Data Stream.

diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab

Evidence

Upstream reference

Environment

Local host

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml

IOC: diantz storing data into alternate data streams.

IOC: diantz getting a file from a remote machine or the internet.

Refs

docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz

ss64.com/nt/makecab-directives.html

lolbas-project.github.io/lolbas/Binaries/Diantz/

Download and compress a remote file and store it in a CAB file on local machine.

Use Download and compress into a cab file.

diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml

IOC: diantz storing data into alternate data streams.

IOC: diantz getting a file from a remote machine or the internet.

Refs

docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz

ss64.com/nt/makecab-directives.html

lolbas-project.github.io/lolbas/Binaries/Diantz/

Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.

Use Bypass command-line based detections

diantz /f {PATH:.ddf}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1036

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml

IOC: diantz storing data into alternate data streams.

IOC: diantz getting a file from a remote machine or the internet.

Refs

docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz

ss64.com/nt/makecab-directives.html

lolbas-project.github.io/lolbas/Binaries/Diantz/