New Self Extracting Package Created Via IExpress.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Source: github.com/SigmaHQ/sigma

Detects the "iexpress.exe" utility creating self-extracting packages. Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files. Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.

Known false positives

Administrators building packages using iexpress.exe

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: New Self Extracting Package Created Via IExpress.EXE
id: c2b478fc-09bf-40b2-8768-ab3ec8d61c9a
status: test
description: |
    Detects the "iexpress.exe" utility creating self-extracting packages.
    Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
    Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.
references:
    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
    - https://en.wikipedia.org/wiki/IExpress
    - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2024-02-05
tags:
    - attack.stealth
    - attack.t1218
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_1_parent:
        ParentImage|endswith: '\iexpress.exe'
    selection_1_img:
        - Image|endswith: '\makecab.exe'
        - OriginalFileName: 'makecab.exe'
    selection_2_img:
        - Image|endswith: '\iexpress.exe'
        - OriginalFileName: 'IEXPRESS.exe'
    selection_2_cli:
        CommandLine|contains: ' /n '
    condition: all of selection_1_* or all of selection_2_*
falsepositives:
    - Administrators building packages using iexpress.exe
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_1_* or all of selection_2_*

Stage 1: `selection_1_parent`

selection_1_parent:
    ParentImage|endswith: '\iexpress.exe'

Stage 2: `selection_1_img`

selection_1_img:
    - Image|endswith: '\makecab.exe'
    - OriginalFileName: 'makecab.exe'

Stage 3: `selection_2_img`

selection_2_img:
    - Image|endswith: '\iexpress.exe'
    - OriginalFileName: 'IEXPRESS.exe'

Stage 4: `selection_2_cli`

selection_2_cli:
    CommandLine|contains: ' /n '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/n` corpus 2 (sigma 2)	`field:"CommandLine" kind:match value:" /n "`
`Image`	ends_with	`\iexpress.exe` corpus 2 (sigma 2) `\makecab.exe` corpus 4 (sigma 4)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`IEXPRESS.exe` corpus 2 (sigma 2) `makecab.exe`	`field:"OriginalFileName" kind:eq`
`ParentImage`	ends_with	`\iexpress.exe`	`field:"ParentImage" kind:ends_with value:"\iexpress.exe"`