Self Extraction Directive File Created In Potentially Suspicious Location (via file_event)

title: Self Extraction Directive File Created In Potentially Suspicious Location (via file_event)
id: e427d757-43da-501d-bd03-346a6d20d426
status: stable
description: This rule detects the creation of Self Extraction Directive files (.sed) in a potentially anomalous location. These files are used by the "iexpress.exe" utility to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
    - https://en.wikipedia.org/wiki/IExpress
    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
author: Huntrule Team
date: 2026-04-14
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - ':\ProgramData\'
            - ':\Temp\'
            - ':\Windows\System32\Tasks\'
            - ':\Windows\Tasks\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
        TargetFilename|endswith: '.sed'
    condition: selection
falsepositives:
    - Unknown
level: medium