Suspicious Diantz Download and Compress Into a CAB File

Title: Suspicious Diantz Download and Compress Into a CAB File
Status: test
Description:Download and compress a remote file and store it in a cab file on local machine.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Diantz/
Author: frack113
Date: 2021-11-26
modified:2022-08-13
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'diantz.exe'
      -' \\\\'
      -'.cab'

  condition:selection
Falsepositives:
  -Unknown
Level: medium