Suspicious Extrac32 Alternate Data Stream Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•14

Detects the use of extrac32.exe to extract data from a cabinet (.cab) file and hide it within an Alternate Data Stream (ADS). This technique can be used for defense evasion by concealing malicious payloads.