Self Extraction Directive File Created In Potentially Suspicious Location

Status: test
Severity: medium
Log source: category file_event, product windows
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Source: github.com/SigmaHQ/sigma

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Self Extraction Directive File Created In Potentially Suspicious Location
id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f
related:
    - id: ab90dab8-c7da-4010-9193-563528cfa347
      type: derived
status: test
description: |
    Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location.
    These files are used by the "iexpress.exe" utility in order to create self extracting packages.
    Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
references:
    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
    - https://en.wikipedia.org/wiki/IExpress
    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2024-02-05
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - ':\ProgramData\'
            - ':\Temp\'
            - ':\Windows\System32\Tasks\'
            - ':\Windows\Tasks\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
        TargetFilename|endswith: '.sed'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|contains:
        - ':\ProgramData\'
        - ':\Temp\'
        - ':\Windows\System32\Tasks\'
        - ':\Windows\Tasks\'
        - ':\Windows\Temp\'
        - '\AppData\Local\Temp\'
    TargetFilename|endswith: '.sed'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.sed` corpus 2 (sigma 2)	`field:"TargetFilename" kind:ends_with value:".sed"`
`TargetFilename`	match	`:\ProgramData\` corpus 4 (sigma 4) `:\Temp\` corpus 5 (sigma 5) `:\Windows\System32\Tasks\` corpus 2 (sigma 2) `:\Windows\Tasks\` corpus 2 (sigma 2) `:\Windows\Temp\` corpus 2 (sigma 2) `\AppData\Local\Temp\` corpus 8 (sigma 8)	`field:"TargetFilename" kind:match`