Windows: Detect .sed Directive File Creation in Suspicious Directories

Alerts on .sed directive file creation under ProgramData/Temp/Tasks paths on Windows, consistent with iExpress-based packaging abuse.

FreeUnreviewedSigmamediumv1

windows-detect-sed-directive-file-creation-in-suspicious-directories-760e75d8

title: "Windows: Detect .sed Directive File Creation in Suspicious Directories"
id: 32cece5f-497c-44c6-afb4-026e456eacf3
related:
  - id: ab90dab8-c7da-4010-9193-563528cfa347
    type: derived
  - id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f
    type: derived
status: test
description: This rule flags creation of Self Extraction Directive (.sed) files in locations commonly abused for staging and execution, including ProgramData, Temp, Windows Tasks, and AppData Local Temp. Attackers can use .sed directives with iExpress packaging to generate self-extracting artifacts that may embed PE-related content. It relies on Windows file event telemetry capturing the created file path and checking for directory substrings and a .sed filename suffix.
references:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sed_file_creation.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-02-05
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - :\ProgramData\
      - :\Temp\
      - :\Windows\System32\Tasks\
      - :\Windows\Tasks\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
    TargetFilename|endswith: .sed
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags creation of Self Extraction Directive (.sed) files in locations commonly abused for staging and execution, including ProgramData, Temp, Windows Tasks, and AppData Local Temp. Attackers can use .sed directives with iExpress packaging to generate self-extracting artifacts that may embed PE-related content. It relies on Windows file event telemetry capturing the created file path and checking for directory substrings and a .sed filename suffix.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.