Makecab.exe

type: OSBinaries

Binary to package existing files into a cabinet (.cab) file

Full path

C:\Windows\System32\makecab.exe
C:\Windows\SysWOW64\makecab.exe

Commands

ADSUser T1564.004
Hide data compressed into an alternate data stream
```
makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab
```
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type: Compression
ADSUser T1564.004
Hide data compressed into an alternate data stream
```
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab
```
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type: Compression
DownloadUser T1105
Download file and compress into a cab file
```
makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
```
Download and compresses the target file and stores it in the target file.
os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type: Compression
ExecuteUser T1036
Bypass command-line based detections
```
makecab /F {PATH:.ddf}
```
Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
os: Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type: Compression

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml
Elastic https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
IOCMakecab retrieving files from Internet
IOCMakecab storing data into alternate data streams

Resources

acknowledgement: Oddvar Moe @oddvarmoe