Extract to ADS, copy or overwrite a file with Extrac32.exe
extrac32.exe /C C:\Windows\System32\calc.exe C:\Users\user\Desktop\calc.exe
Command for copying calc.exe to another folder
Copy file
C:\Windows\System32\extrac32.exe, C:\Windows\SysWOW64\extrac32.exe
Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
egre55 (@egre55), Oddvar Moe (@oddvarmoe), Hai Vaknin(Lux (@VakninHai), Tamir Yehuda (@tim8288)