Windows Diantz.exe Command-Line ADS CAB Creation

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.004NTFS File Attributes
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies execution of Diantz.exe with command-line arguments indicating creation of a .cab file stored in an Alternate Data Stream (ADS) of a target file. This behavior can be used to conceal payloads or artifacts within file metadata, reducing visibility during casual inspection. The detection relies on process creation telemetry and matches the presence of Diantz.exe/.cab along with an ADS path indicator in the command line.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

Suspicious Run Key Referencing Alternate Data Stream Payload

macOS chflags Hidden Flag Set via chflags hidden parameter

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Windows suspicious file download URLs using direct IP address with script/binary extensions

Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs

Windows Diantz.exe Command-Line ADS CAB Creation

Pivot detection · T1564.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-diantz-alternate-data-stream-ads-cab-execution-via-command-line-6b369ced

title: Windows Diantz.exe Command-Line ADS CAB Creation
id: 6241d7db-da5d-4826-b2ed-f4d0703e3a64
status: test
description: Identifies execution of Diantz.exe with command-line arguments indicating creation of a .cab file stored in an Alternate Data Stream (ADS) of a target file. This behavior can be used to conceal payloads or artifacts within file metadata, reducing visibility during casual inspection. The detection relies on process creation telemetry and matches the presence of Diantz.exe/.cab along with an ADS path indicator in the command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Diantz/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml
author: frack113, Huntrule Team
date: 2021-11-26
modified: 2022-12-31
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - diantz.exe
      - .cab
    CommandLine|re: :[^\\]
  condition: selection
falsepositives:
  - Very Possible
level: medium
license: DRL-1.1
related:
  - id: 6b369ced-4b1d-48f1-b427-fdc0de0790bd
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL