Makecab.exe

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

Use Hide data compressed into an alternate data stream

makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

IOC: Makecab retrieving files from Internet

IOC: Makecab storing data into alternate data streams

Refs

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

ss64.com/nt/makecab-directives.html

www.pearsonhighered.com/assets/samplechapter/0/7/8/9/0789728583.pdf

learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)#makecab-application

lolbas-project.github.io/lolbas/Binaries/Makecab/

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

Use Hide data compressed into an alternate data stream

makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

IOC: Makecab retrieving files from Internet

IOC: Makecab storing data into alternate data streams

Refs

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

ss64.com/nt/makecab-directives.html

www.pearsonhighered.com/assets/samplechapter/0/7/8/9/0789728583.pdf

learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)#makecab-application

lolbas-project.github.io/lolbas/Binaries/Makecab/

Download and compresses the target file and stores it in the target file.

Use Download file and compress into a cab file

makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

IOC: Makecab retrieving files from Internet

IOC: Makecab storing data into alternate data streams

Refs

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

ss64.com/nt/makecab-directives.html

www.pearsonhighered.com/assets/samplechapter/0/7/8/9/0789728583.pdf

learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)#makecab-application

lolbas-project.github.io/lolbas/Binaries/Makecab/

Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.

Use Bypass command-line based detections

makecab /F {PATH:.ddf}

Context

user

Native

Execute

MITRE

T1036

Detection

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml

Elastic: github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

IOC: Makecab retrieving files from Internet

IOC: Makecab storing data into alternate data streams

Refs

gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f

ss64.com/nt/makecab-directives.html

www.pearsonhighered.com/assets/samplechapter/0/7/8/9/0789728583.pdf

learn.microsoft.com/en-us/previous-versions/bb417343(v=msdn.10)#makecab-application

lolbas-project.github.io/lolbas/Binaries/Makecab/