Binary that package existing files into a cabinet (.cab) file Located at: c:\windows\system32\diantz.exe; c:\windows\syswow64\diantz.exe.
diantzdiantzSandbox: execFile · Timeout: 30s
system.file.alternate-data-stream network.transfer.download security.execution.command Outputs
process.output Command execution output
filesystem_writeprocess_spawnnetwork_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file. (Hide data compressed into an Alternate Data Stream.)
diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cabDownload and compress a remote file and store it in a CAB file on local machine. (Download and compress into a cab file.)
diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification. (Bypass command-line based detections)
diantz /f {PATH:.ddf}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml |
| sigma | https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml |
| ioc | diantz storing data into alternate data streams. |
| ioc | diantz getting a file from a remote machine or the internet. |
diantz is a Windows LOLBin. Binary that package existing files into a cabinet (.cab) file Located at: c:\windows\system32\diantz.exe; c:\windows\syswow64\diantz.exe.