huntrule

Windows: Alert on new .sed file creation consistent with self-extraction directive use

Flags creation of newly created .sed directive files on Windows, which can be used for self-extracting package abuse.

FreeUnreviewedSigmamediumv1
title: "Windows: Alert on new .sed file creation consistent with self-extraction directive use"
id: eac7304c-fd27-47ae-9d8a-c87508df8830
related:
  - id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f
    type: derived
  - id: ab90dab8-c7da-4010-9193-563528cfa347
    type: derived
status: test
description: This rule flags the creation of files whose names end with the .sed extension on Windows. .sed files are commonly used as self-extraction directive inputs for iExpress and may be abused to package or stage executables in a way that can evade casual inspection. The detection relies on file creation/creation-style telemetry that records the target filename.
references:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-02-05
tags:
  - attack.stealth
  - attack.t1218
logsource:
  product: windows
  category: file_executable_detected
detection:
  selection:
    TargetFilename|endswith: .sed
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags the creation of files whose names end with the .sed extension on Windows. .sed files are commonly used as self-extraction directive inputs for iExpress and may be abused to package or stage executables in a way that can evade casual inspection. The detection relies on file creation/creation-style telemetry that records the target filename.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.