Suspicious Diantz Alternate Data Stream Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of 'diantz.exe' with command-line arguments indicating the creation of a cabinet (.cab) file and the use of an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious data within legitimate files.