Skip to content

Add rule to detect makecab staging of LOLBins #5254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
alexegorov1 wants to merge 1 commit into from
Closed

Add rule to detect makecab staging of LOLBins #5254

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions rules/windows/process_creation/win_sysmon_susp_makecab_lolbin_usage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
title: Suspicious Makecab Usage Against Known LOLBins
id: 14fdd486-8a7d-4772-a0b2-be7335f3c008
status: experimental
description: |
Detects usage of makecab.exe to compress known LOLBins (regsvr32, rundll32, mshta, certreq).
Attackers often use this technique for staging and defense evasion.
This rule specifically looks for makecab.exe referencing these binaries in its command line,
which is typically uncommon in normal environments.
references:
- https://lolbas-project.github.io
- https://attack.mitre.org/techniques/T1560/001
- https://car.mitre.org/analytics/CAR-2020-05-003
Comment on lines +10 to +12
Copy link
Member

@nasbench nasbench Apr 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you share a public reference or paste a log that you tested.

Copy link
Author

@alexegorov1 alexegorov1 May 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the note. Here are a few solid public references that directly support this detection logic:

  1. https://attack.mitre.org/techniques/T1560/001/
    MITRE documents this technique (T1560.001 - Archive via Utility) as attackers using built-in tools like makecab.exe to compress files before exfiltration. The page explicitly names makecab.exe as an example of a native archiving tool abused for staging payloads or data. That’s exactly the use case this rule focuses on — detecting unusual makecab usage as part of attacker tooling.
  2. https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a
    This official CISA alert (AA22-055A) covers the MuddyWater APT group. In the TTP section, it mentions use of makecab.exe to compress stolen data during real-world operations. This shows the tool isn’t just theoretical — it’s been used by adversaries for the same kind of activity this rule is trying to flag.
  3. https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/
    Rapid7 analyzed attacker behavior during live exploitation of Exchange servers. One of the behaviors observed was using makecab.exe to compress an lsass.dmp file — again, built-in compression as part of staging sensitive files for transfer. It is not LOLBins specifically, but this supports the broader pattern of malicious use of makecab.exe on high-value binaries.

Each of these sources shows how makecab.exe can be used in post-exploitation for staging — especially when paired with system binaries like regsvr32, mshta, or certreq. So this rule aims to detect: cases where known LOLBins are being packaged, which is almost never normal in real environments.

Let me know if anything else is needed — I can send logs if helpful, but wanted to keep it clean for now.

author: alexegorov1
date: 2025-04-04
tags:
- attack.execution
- attack.defense-evasion
- attack.t1218
logsource:
product: windows
category: process_creation
service: sysmon
detection:
selection_makecab_lolbins:
Image|contains: 'makecab.exe'
CommandLine|contains:
- 'regsvr32.exe'
- 'certreq.exe'
- 'rundll32.exe'
- 'mshta.exe'
condition: selection_makecab_lolbins
fields:
- CommandLine
- ParentImage
- ParentCommandLine
- CurrentDirectory
falsepositives:
- Rare legitimate packaging scenarios involving these tools
level: medium