Windows extrac32.exe CAB extraction via Alternate Data Stream execution

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.004NTFS File Attributes
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where the command line invokes extrac32.exe with a .cab argument and includes a colon that is not followed by a backslash, indicative of Alternate Data Stream-style targeting. Attackers can use ADS to hide extracted payloads or artifacts from casual inspection and some file-based defenses. It relies on Windows process creation telemetry capturing the full command line.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

Suspicious Run Key Referencing Alternate Data Stream Payload

macOS chflags Hidden Flag Set via chflags hidden parameter

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Windows suspicious file download URLs using direct IP address with script/binary extensions

Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs

Windows extrac32.exe CAB extraction via Alternate Data Stream execution

Pivot detection · T1564.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-extrac32-exe-execution-with-alternate-data-stream-targeting-4b13db67

title: Windows extrac32.exe CAB extraction via Alternate Data Stream execution
id: 7c4ce0d9-bae6-4a27-bb80-4010faa588b3
status: test
description: This rule flags process creation where the command line invokes extrac32.exe with a .cab argument and includes a colon that is not followed by a backslash, indicative of Alternate Data Stream-style targeting. Attackers can use ADS to hide extracted payloads or artifacts from casual inspection and some file-based defenses. It relies on Windows process creation telemetry capturing the full command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
author: frack113, Huntrule Team
date: 2021-11-26
modified: 2022-12-30
tags:
  - attack.stealth
  - attack.t1564.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - extrac32.exe
      - .cab
    CommandLine|re: :[^\\]
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4b13db67-0c45-40f1-aba8-66a1a7198a1e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL