Windows: Creation of .diagcab Files

Alerts on newly created Windows .diagcab files that may indicate malicious packaging or exploitation.

FreeUnreviewedSigmamediumv1

windows-creation-of-diagcab-files-3d0ed417

title: "Windows: Creation of .diagcab Files"
id: 5231773d-f72a-452b-947b-82e65af39d7b
status: test
description: This rule flags file creation events where the target filename ends with .diagcab. Attackers may use diagcab packages to stage or deliver components during exploitation, so unexpected .diagcab files warrant review. The detection relies on Windows file event telemetry that provides the created/target filename to match the .diagcab suffix.
references:
  - https://threadreaderapp.com/thread/1533879688141086720.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_diagcab.yml
author: frack113, Huntrule Team
date: 2022-06-08
tags:
  - attack.resource-development
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .diagcab
  condition: selection
falsepositives:
  - Legitimate microsoft diagcab
level: medium
license: DRL-1.1
related:
  - id: 3d0ed417-3d94-4963-a562-4a92c940656a
    type: derived

What it detects

This rule flags file creation events where the target filename ends with .diagcab. Attackers may use diagcab packages to stage or deliver components during exploitation, so unexpected .diagcab files warrant review. The detection relies on Windows file event telemetry that provides the created/target filename to match the .diagcab suffix.

Known false positives

Legitimate microsoft diagcab

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.