Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Suspicious Diantz Alternate Data Stream Execution

Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Fri Nov 26Updated Sat Dec 316b369ced-4b1d-48f1-b427-fdc0de0790bdwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - diantz.exe
            - .cab
        CommandLine|re: ':[^\\]'
    condition: selection
False Positives

Very Possible

References
1
Resolving title…
lolbas-project.github.io
MITRE ATT&CK
Rule Metadata
Rule ID
6b369ced-4b1d-48f1-b427-fdc0de0790bd
Status
test
Level
medium
Type
Detection
Created
Fri Nov 26
Modified
Sat Dec 31
Author
François Hubaut
Path
rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml
Raw Tags
attack.defense-evasionattack.t1564.004
View on GitHub