{"id":"b2b048b0-7857-4380-b0fb-d3f0ab820b71","title":"Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location","description":"Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.\nThis behavior has been observed in-the-wild by different threat actors.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-02-05","modified":"2024-06-04","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Administrators building packages using iexpress.exe"],"references":["https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html","https://en.wikipedia.org/wiki/IExpress","https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/","https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior"],"source_path":"rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml","source_sha256":"5319410ec73a2f15e7702d6591ec5334a42775badd9679d7edb056ebacd4440a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location\nid: b2b048b0-7857-4380-b0fb-d3f0ab820b71\nstatus: test\ndescription: |\n    Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.\n    This behavior has been observed in-the-wild by different threat actors.\nreferences:\n    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html\n    - https://en.wikipedia.org/wiki/IExpress\n    - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/\n    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)\ndate: 2024-02-05\nmodified: 2024-06-04\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    # VT Query: behavior_processes:\"iexpress.exe\" and behavior_processes:\"/n /q /m\" and behavior_processes:\"*.sed*\" and p:5+\n    selection_img:\n        - Image|endswith: '\\iexpress.exe'\n        - OriginalFileName: 'IEXPRESS.exe'\n    selection_cli:\n        CommandLine|contains|windash: ' /n '\n    selection_paths:\n        CommandLine|contains:\n            # Note: Add more uncommon paths that fit your organizational needs.\n            - ':\\ProgramData\\'\n            - ':\\Temp\\'\n            - ':\\Windows\\System32\\Tasks\\'\n            - ':\\Windows\\Tasks\\'\n            - ':\\Windows\\Temp\\'\n            - '\\AppData\\Local\\Temp\\'\n    condition: all of selection_*\nfalsepositives:\n    - Administrators building packages using iexpress.exe\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/b2b048b0-7857-4380-b0fb-d3f0ab820b71.json","kind":"sigma"}