huntrule

Windows Suspicious extrac32.exe Execution with Alternate Data Stream Targeting

Flags Windows executions of extrac32.exe that target a .cab and include an alternate data stream path indicator.

FreeUnreviewedSigmamediumv1
title: Windows Suspicious extrac32.exe Execution with Alternate Data Stream Targeting
id: 7c4ce0d9-bae6-4a27-bb80-4010faa588b3
status: test
description: This rule matches process creation command lines that include extrac32.exe and a .cab file, along with an alternate data stream indicator (a colon not followed by a backslash). Attackers can use Alternate Data Streams on NTFS to hide extracted or staged content while maintaining a normal-looking executable flow. It relies on Windows process creation telemetry with command-line arguments.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
author: frack113, Huntrule Team
date: 2021-11-26
modified: 2022-12-30
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - extrac32.exe
      - .cab
    CommandLine|re: :[^\\]
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4b13db67-0c45-40f1-aba8-66a1a7198a1e
    type: derived

What it detects

This rule matches process creation command lines that include extrac32.exe and a .cab file, along with an alternate data stream indicator (a colon not followed by a backslash). Attackers can use Alternate Data Streams on NTFS to hide extracted or staged content while maintaining a normal-looking executable flow. It relies on Windows process creation telemetry with command-line arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.