Suspicious Diantz Alternate Data Stream Execution

Title: Suspicious Diantz Alternate Data Stream Execution
Status: test
Description:Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Diantz/
Author: frack113
Date: 2021-11-26
modified:2022-12-31
Tags:

• -'attack.stealth'
• -'attack.t1564.004'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'diantz.exe'
      -'.cab'

    CommandLine|re: ':[^\\]'
  condition:selection
Falsepositives:
  -Very Possible
Level: medium