Creation of Potentially Suspicious Self Extraction Directive File (via file_executable_detected)

title: Creation of Potentially Suspicious Self Extraction Directive File (via file_executable_detected)
id: e22b08dc-5fc1-59ef-8bb8-8b0c87498cb6
status: stable
description: This rule detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
    - https://en.wikipedia.org/wiki/IExpress
    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
author: Huntrule Team
date: 2026-02-25
tags:
    - attack.stealth
    - attack.t1218
logsource:
    product: windows
    category: file_executable_detected
detection:
    selection:
        TargetFilename|endswith: '.sed'
    condition: selection
falsepositives:
    - Unknown
level: medium