detection.wiki

Detection rules › Sigma

Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.

MITRE ATT&CK coverage

TacticTechniques
StealthT1218 System Binary Proxy Execution

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
id: b2b048b0-7857-4380-b0fb-d3f0ab820b71
status: test
description: |
    Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
    This behavior has been observed in-the-wild by different threat actors.
references:
    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
    - https://en.wikipedia.org/wiki/IExpress
    - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
date: 2024-02-05
modified: 2024-06-04
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    # VT Query: behavior_processes:"iexpress.exe" and behavior_processes:"/n /q /m" and behavior_processes:"*.sed*" and p:5+
    selection_img:
        - Image|endswith: '\iexpress.exe'
        - OriginalFileName: 'IEXPRESS.exe'
    selection_cli:
        CommandLine|contains|windash: ' /n '
    selection_paths:
        CommandLine|contains:
            # Note: Add more uncommon paths that fit your organizational needs.
            - ':\ProgramData\'
            - ':\Temp\'
            - ':\Windows\System32\Tasks\'
            - ':\Windows\Tasks\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
    condition: all of selection_*
falsepositives:
    - Administrators building packages using iexpress.exe
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\iexpress.exe'
    - OriginalFileName: 'IEXPRESS.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|windash: ' /n '

Stage 3: selection_paths

selection_paths:
    CommandLine|contains:
        - ':\ProgramData\'
        - ':\Temp\'
        - ':\Windows\System32\Tasks\'
        - ':\Windows\Tasks\'
        - ':\Windows\Temp\'
        - '\AppData\Local\Temp\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /n transforms: windash corpus 2 (sigma 2)
  • :\ProgramData\ corpus 9 (sigma 9)
  • :\Temp\ corpus 14 (sigma 14)
  • :\Windows\System32\Tasks\ corpus 4 (sigma 4)
  • :\Windows\Tasks\ corpus 6 (sigma 6)
  • :\Windows\Temp\ corpus 16 (sigma 16)
  • \AppData\Local\Temp\ corpus 26 (sigma 26)
Imageends_with
  • \iexpress.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • IEXPRESS.exe corpus 2 (sigma 2)