Windows: Detect IExpress creating self-extracting packages via Makecab

Identifies IExpress.exe usage to generate self-extracting packages, including makecab.exe involvement and IExpress command-line patterns.

FreeUnreviewedSigmamediumv1

windows-detect-iexpress-creating-self-extracting-packages-via-makecab-c2b478fc

title: "Windows: Detect IExpress creating self-extracting packages via Makecab"
id: 76762cfb-1d99-43ae-b969-c6e040bd3791
status: test
description: This rule flags process creation events where IExpress is used to build self-extracting packages, including cases involving makecab.exe. It matters because attackers can use legitimate packaging utilities to compile and deliver payloads while blending in with normal software build workflows. The detection relies on Windows process creation telemetry, matching parent/child image relationships and specific command-line patterns associated with IExpress and makecab.
references:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_iexpress_execution.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-02-05
tags:
  - attack.stealth
  - attack.t1218
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_1_parent:
    ParentImage|endswith: \iexpress.exe
  selection_1_img:
    - Image|endswith: \makecab.exe
    - OriginalFileName: makecab.exe
  selection_2_img:
    - Image|endswith: \iexpress.exe
    - OriginalFileName: IEXPRESS.exe
  selection_2_cli:
    CommandLine|contains: " /n "
  condition: all of selection_1_* or all of selection_2_*
falsepositives:
  - Administrators building packages using iexpress.exe
level: medium
license: DRL-1.1
related:
  - id: c2b478fc-09bf-40b2-8768-ab3ec8d61c9a
    type: derived

What it detects

This rule flags process creation events where IExpress is used to build self-extracting packages, including cases involving makecab.exe. It matters because attackers can use legitimate packaging utilities to compile and deliver payloads while blending in with normal software build workflows. The detection relies on Windows process creation telemetry, matching parent/child image relationships and specific command-line patterns associated with IExpress and makecab.

Known false positives

Administrators building packages using iexpress.exe

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.