Windows: Alert on iexpress.exe Self Extraction Directive (SED) package creation from suspicious paths

Flags suspicious use of Windows iexpress.exe to create self-extracting packages via SED directives from uncommon/temp paths.

FreeUnreviewedSigmahighv1

windows-alert-on-iexpress-exe-self-extraction-directive-sed-package-creation-fro-b2b048b0

title: "Windows: Alert on iexpress.exe Self Extraction Directive (SED) package creation from suspicious paths"
id: 0a0ae07c-b8e8-47f8-bfc2-719b5d8a8240
status: test
description: This rule flags process creation of IExpress (iexpress.exe) when executed from potentially suspicious locations and with self-extract directive related command-line usage. Attackers can use iexpress to generate executable content from SED files, which may help stealthily package or stage payloads. The detection relies on Windows process creation telemetry, matching process image/filename, specific command-line patterns, and the presence of targeted path strings.
references:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-05
modified: 2024-06-04
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \iexpress.exe
    - OriginalFileName: IEXPRESS.exe
  selection_cli:
    CommandLine|contains|windash: " /n "
  selection_paths:
    CommandLine|contains:
      - :\ProgramData\
      - :\Temp\
      - :\Windows\System32\Tasks\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
  condition: all of selection_*
falsepositives:
  - Administrators building packages using iexpress.exe
level: high
license: DRL-1.1
related:
  - id: b2b048b0-7857-4380-b0fb-d3f0ab820b71
    type: derived

What it detects

This rule flags process creation of IExpress (iexpress.exe) when executed from potentially suspicious locations and with self-extract directive related command-line usage. Attackers can use iexpress to generate executable content from SED files, which may help stealthily package or stage payloads. The detection relies on Windows process creation telemetry, matching process image/filename, specific command-line patterns, and the presence of targeted path strings.

Known false positives

Administrators building packages using iexpress.exe

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.