Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Suspicious Extrac32 Alternate Data Stream Execution

Extract data from cab file and hide it in an alternate data stream

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Fri Nov 26Updated Fri Dec 304b13db67-0c45-40f1-aba8-66a1a7198a1ewindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - extrac32.exe
            - .cab
        CommandLine|re: ':[^\\]'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
lolbas-project.github.io
MITRE ATT&CK
Rule Metadata
Rule ID
4b13db67-0c45-40f1-aba8-66a1a7198a1e
Status
test
Level
medium
Type
Detection
Created
Fri Nov 26
Modified
Fri Dec 30
Author
François Hubaut
Path
rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
Raw Tags
attack.defense-evasionattack.t1564.004
View on GitHub