Windows: Alert on expand.exe Cabinet File Expansion from Uncommon Paths

Flags expand.exe ("-F:") extracting cabinets when used from suspicious/uncommon Windows paths.

FreeUnreviewedSigmamediumv1

windows-alert-on-expand-exe-cabinet-file-expansion-from-uncommon-paths-9f107a84

title: "Windows: Alert on expand.exe Cabinet File Expansion from Uncommon Paths"
id: 4c525ce6-793c-476a-84b0-fe3cd42cf064
status: test
description: This rule flags Windows process executions of expand.exe with cabinet extraction parameters (including "-F:") when the command line references uncommon or potentially attacker-controlled locations (e.g., ProgramData, Perflogs, Temp, admin shares, and other user-accessible paths). Cabinet expansion can be used to stage or unpack payloads while blending into normal Windows tooling, so monitoring this behavior helps identify stealthy dropper activity. It relies on process creation telemetry including Image and CommandLine, and optionally filters a specific Dell ServiceShell.exe parent process.
references:
  - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll
  - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml
author: Bhabesh Raj, X__Junior (Nextron Systems), Huntrule Team
date: 2021-07-30
modified: 2024-11-13
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    Image|endswith: \expand.exe
    CommandLine|contains|windash: "-F:"
  selection_folders_1:
    CommandLine|contains:
      - :\Perflogs\
      - :\ProgramData
      - :\Users\Public\
      - :\Windows\Temp\
      - \Admin$\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
      - \C$\
      - \Temporary Internet
  selection_folders_2:
    - CommandLine|contains|all:
        - :\Users\
        - \Favorites\
    - CommandLine|contains|all:
        - :\Users\
        - \Favourites\
    - CommandLine|contains|all:
        - :\Users\
        - \Contacts\
  filter_optional_dell:
    ParentImage: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe
    CommandLine|contains: C:\ProgramData\Dell\UpdateService\Temp\
  condition: selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_*
falsepositives:
  - System administrator Usage
level: medium
license: DRL-1.1
related:
  - id: 9f107a84-532c-41af-b005-8d12a607639f
    type: derived

What it detects

This rule flags Windows process executions of expand.exe with cabinet extraction parameters (including "-F:") when the command line references uncommon or potentially attacker-controlled locations (e.g., ProgramData, Perflogs, Temp, admin shares, and other user-accessible paths). Cabinet expansion can be used to stage or unpack payloads while blending into normal Windows tooling, so monitoring this behavior helps identify stealthy dropper activity. It relies on process creation telemetry including Image and CommandLine, and optionally filters a specific Dell ServiceShell.exe parent process.

Known false positives

System administrator Usage

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.