Windows File Creation of .diagcab Packages
Alerts on newly created Windows .diagcab files that may indicate malicious packaging or exploitation.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-06-08
- Updated
- 2026-07-31
What it detects
This rule flags file events where a newly created file has a filename ending in .diagcab, which can indicate Windows diagnostic package deployment. Attackers may use this artifact to blend into legitimate diagnostic content or stage supporting files during exploitation. Telemetry relies on Windows file creation events and the TargetFilename suffix.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-creation-of-diagcab-files-3d0ed417
title: Windows File Creation of .diagcab Packages
id: 5231773d-f72a-452b-947b-82e65af39d7b
status: test
description: This rule flags file events where a newly created file has a filename ending in .diagcab, which can indicate Windows diagnostic package deployment. Attackers may use this artifact to blend into legitimate diagnostic content or stage supporting files during exploitation. Telemetry relies on Windows file creation events and the TargetFilename suffix.
references:
- https://threadreaderapp.com/thread/1533879688141086720.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_diagcab.yml
author: frack113, Huntrule Team
date: 2022-06-08
tags:
- attack.resource-development
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: .diagcab
condition: selection
falsepositives:
- Legitimate microsoft diagcab
level: medium
license: DRL-1.1
related:
- id: 3d0ed417-3d94-4963-a562-4a92c940656a
type: derived