Sigma rule: New Self Extracting Package Created Via IExpress.EXE

Rule

Title

New Self Extracting Package Created Via IExpress.EXE

Status

test

Level

medium

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Date

2024-02-05

File

rules-threat-hunting/windows/process_creation/proc_creation_win_iexpress_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the "iexpress.exe" utility creating self-extracting packages.
Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.

Log source

product

windows

category

process_creation

Detection

selection_1_parent:
    ParentImage|endswith: '\iexpress.exe'
selection_1_img:
    - Image|endswith: '\makecab.exe'
    - OriginalFileName: 'makecab.exe'
selection_2_img:
    - Image|endswith: '\iexpress.exe'
    - OriginalFileName: 'IEXPRESS.exe'
selection_2_cli:
    CommandLine|contains: ' /n '
condition: all of selection_1_* or all of selection_2_*

False positives (as the rule lists them)

• Administrators building packages using iexpress.exe

Tags

• attack.stealth
• attack.t1218
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1218

References

• https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
• https://en.wikipedia.org/wiki/IExpress
• https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
• https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/process_creation/proc_creation_win_iexpress_execution.yml