{"id":"9f107a84-532c-41af-b005-8d12a607639f","title":"Potentially Suspicious Cabinet File Expansion","description":"Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks","author":"Bhabesh Raj, X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2021-07-30","modified":"2024-11-13","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["System administrator Usage"],"references":["https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll","https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"],"source_path":"rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml","source_sha256":"202cbe457a525f578e80f43b244674f90e96f10b808e0f405ff52c9707ceabd9","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Cabinet File Expansion\nid: 9f107a84-532c-41af-b005-8d12a607639f\nstatus: test\ndescription: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks\nreferences:\n    - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll\n    - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/\nauthor: Bhabesh Raj, X__Junior (Nextron Systems)\ndate: 2021-07-30\nmodified: 2024-11-13\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmd:\n        Image|endswith: '\\expand.exe'\n        CommandLine|contains|windash: '-F:'\n    selection_folders_1:\n        CommandLine|contains:\n            - ':\\Perflogs\\'\n            - ':\\ProgramData'\n            - ':\\Users\\Public\\'\n            - ':\\Windows\\Temp\\'\n            - '\\Admin$\\'\n            - '\\AppData\\Local\\Temp\\'\n            - '\\AppData\\Roaming\\'\n            - '\\C$\\'\n            - '\\Temporary Internet'\n    selection_folders_2:\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Favorites\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Favourites\\'\n        - CommandLine|contains|all:\n              - ':\\Users\\'\n              - '\\Contacts\\'\n    filter_optional_dell:\n        # Launched by Dell ServiceShell.exe\n        ParentImage: 'C:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe'\n        CommandLine|contains: 'C:\\ProgramData\\Dell\\UpdateService\\Temp\\'\n    condition: selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_*\nfalsepositives:\n    - System administrator Usage\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/9f107a84-532c-41af-b005-8d12a607639f.json","kind":"sigma"}