Ceplin Command Identifier

Identifier / Programs / Windows

makecab.exe

Package existing files into a cabinet (.cab) file. Windows commands reference

LOLBAS ADS, Download, Execute 3 Sigma rules name it 3 ATT&CK techniques 4 documented commands 12 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How makecab.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

Download T1105 Ingress Tool Transfer

Execute T1036 Masquerading

/fA file with makecab directives (may be repeated). Windows commands reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for makecab.exe.

4 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

makecab {PATH_ABSOLUTE:.exe} {PATH_ABSOLUTE}:autoruns.cab
Identify

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Compresses the target file into a CAB file stored in the Alternate Data Stream (ADS) of the target file.

makecab {PATH_SMB:.exe} {PATH_ABSOLUTE}:file.cab
Identify

Download T1105 Ingress Tool Transfer User privileges

Download and compresses the target file and stores it in the target file.

makecab {PATH_SMB:.exe} {PATH_ABSOLUTE:.cab}
Identify

Execute T1036 Masquerading User privileges

Execute makecab commands as defined in the specified Diamond Definition File (.ddf); see resources for the format specification.

makecab /F {PATH:.ddf}
Identify

None of the 4 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for makecab.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for makecab.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
criticalHAFNIUM Exchange Exploitation ActivityFlorian Roth (Nextron Systems)
highPotential Exploitation of RCE Vulnerability CVE-2025-33053Swachchhanda Shrawan Poudel (Nextron Systems)
mediumNew Self Extracting Package Created Via IExpress.EXEJoseliyo Sanchez, @Joseliyo_Jstnk
T1036Masquerading
T1105Ingress Tool Transfer
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real makecab.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMicrosoft Cabinet Maker

12 known copies

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\makecab.exe · not signed

2a0040b54311fb62153131d4b201150ab058b7f85f7f5a7f8751a6db2b08669e

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\makecab.exe · not signed

6992e53ab2d927d6131142e328ba5d6d985c2a7eb64dc5cea4d8980dcf03e768

5.00 (rs1_release.200407-1730) · C:\Windows\SysWOW64\makecab.exe · signed by Microsoft Windows

7661727cd39b5ba6f21e0d7b5ade6da8d55a9594d155a235553b58a10c054b43

5.00 (rs1_release.200407-1730) · C:\Windows\system32\makecab.exe · signed by Microsoft Windows

e73754e12402679c921e4903c4e1130dca6a3714ff7a42866aa38692ad0874f4

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\makecab.exe · signed by Microsoft Windows

6fe68e81da381f3bd1852e18d9223f73d453dd08a9c076b10c3852a1381d802e

5.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\makecab.exe · signed by Microsoft Windows

84146980aba210fb46fa4c8436254abda1e3ed29efacbea06dea693086fba983

5.00 (WinBuild.160101.0800) · C:\Windows\system32\makecab.exe · signed by Microsoft Windows

ba31ad8eca19c5fe03f6a5c64c8e0adfc7bd8d04b1f4e1c11d167467fd5261e9

5.00 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\makecab.exe · signed by Microsoft Windows

c02d0fdc0d2694efe264d539345bfee621ea173cbf4be29e2a1d3ea282b06e69

5.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\makecab.exe · signed by Microsoft Windows

c55818c51e4a42dd2f9194ce754596a23f1ec3186092b1546b2409b1b3577c7e

5.00 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\makecab.exe · signed by Microsoft Windows

da0a9dee221007b711c31c974b8dfff2f56744d347669da7e468914bd4096d31

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\makecab.exe · signed by Microsoft Windows

f3c190724c35d35da5213daeb868dade5556eaea69a9337dedd6402cf4c42e48

5.00 (WinBuild.160101.0800) · C:\Windows\system32\makecab.exe · signed by Microsoft Windows

f9ebaa95c93aa8ce217a4ad8715ccf2b7a3fc7a951da44b78a9bb2c53b9bcace

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Options

5 in Windows commands reference
Show every option of makecab.exe
/fA file with makecab directives (may be repeated).
/dDefines variable with specified value.
/lLocation to place destination (default is current directory).
/vSet debugging verbosity level (0=none,...,3=full).
/?Displays help at the command prompt.

Other programs abused for ADS

bitsadmin.exe · certutil.exe · cmd.exe · control.exe · cscript.exe · diantz.exe · esentutl.exe · expand.exe · extrac32.exe · findstr.exe · forfiles.exe · mavinject.exe · mpcmdrun.exe · mshta.exe · msxsl.exe · print.exe