From 879ea39b6dcc8ead7fa7a637b9b7faf2c787dec7 Mon Sep 17 00:00:00 2001
From: frack113 <magicfrancois@gmail.com>
Date: Wed, 8 Jun 2022 13:39:49 +0200
Subject: [PATCH] Add file_event_win_susp_diagcab

---
 .../file_event_win_susp_diagcab.yml           | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 rules/windows/file_event/file_event_win_susp_diagcab.yml

diff --git a/rules/windows/file_event/file_event_win_susp_diagcab.yml b/rules/windows/file_event/file_event_win_susp_diagcab.yml
new file mode 100644
index 000000000..04824c9d5
--- /dev/null
+++ b/rules/windows/file_event/file_event_win_susp_diagcab.yml
@@ -0,0 +1,20 @@
+title: Creation of a Diagcab
+id: 3d0ed417-3d94-4963-a562-4a92c940656a
+status: experimental
+description: Detects the creation of diagcab file
+author: frack113
+references:
+  - https://threadreaderapp.com/thread/1533879688141086720.html
+date: 2022/06/08
+logsource:
+  product: windows
+  category: file_event
+detection:
+  selection:
+    TargetFilename|endswith: '.diagcab'
+  condition: selection 
+falsepositives:
+  - Legitimate microsoft diagcab 
+level: medium
+tags:
+  - attack.resource_development
\ No newline at end of file