Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add diantz directives LOLBAS information (thanks to makecab research and Microsoft docs) #390

Merged
merged 3 commits into from
Aug 17, 2024
Merged

Add diantz directives LOLBAS information (thanks to makecab research and Microsoft docs) #390

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
76738f6
Add diantz information (thanks to makecab research and Microsoft docs)
TAbdiukov Aug 16, 2024
5944dd4
Update Diantz.yml
wietze Aug 17, 2024
ebcbcca
Update Diantz.yml
wietze Aug 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion yml/OSBinaries/Diantz.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
Name: Diantz.exe
Description: Binary that package existing files into a cabinet (.cab) file
Author: 'Tamir Yehuda'
Author: Tamir Yehuda
Created: 2020-08-08
Commands:
- Command: diantz.exe c:\pathToFile\file.exe c:\destinationFolder\targetFile.txt:targetFile.cab
Expand All @@ -22,6 +22,15 @@ Commands:
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Tags:
- Type: Compression
- Command: diantz /f directives.ddf
Description: Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
Usecase: Bypass command-line based detections
Category: Execute
Privileges: User
MitreID: T1036
OperatingSystem: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Tags:
- Type: Compression
Full_Path:
- Path: c:\windows\system32\diantz.exe
- Path: c:\windows\syswow64\diantz.exe
Expand All @@ -34,6 +43,7 @@ Detection:
- IOC: diantz getting a file from a remote machine or the internet.
Resources:
- Link: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diantz
- Link: https://ss64.com/nt/makecab-directives.html
Acknowledgement:
- Person: Tamir Yehuda
Handle: '@tim8288'
Expand Down
Loading