Binary to package existing files into a cabinet (.cab) file Located at: C:\Windows\System32\makecab.exe; C:\Windows\SysWOW64\makecab.exe.
makecabmakecabSandbox: execFile · Timeout: 30s
system.file.alternate-data-stream network.transfer.download security.execution.command Outputs
process.output Command execution output
filesystem_writeprocess_spawnnetwork_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file. (Hide data compressed into an alternate data stream)
makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cabCompresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file. (Hide data compressed into an alternate data stream)
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cabDownload and compresses the target file and stores it in the target file. (Download file and compress into a cab file)
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification. (Bypass command-line based detections)
makecab /F {PATH:.ddf}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml |
| elastic | https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml |
| ioc | Makecab retrieving files from Internet |
| ioc | Makecab storing data into alternate data streams |
makecab is a Windows LOLBin. Binary to package existing files into a cabinet (.cab) file Located at: C:\Windows\System32\makecab.exe; C:\Windows\SysWOW64\makecab.exe.