Self Extraction Directive File Created In Potentially Suspicious Location

Title: Self Extraction Directive File Created In Potentially Suspicious Location
Status: test
Description:Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
References:
  -https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  -https://en.wikipedia.org/wiki/IExpress
  -https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-02-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|contains:
      -':\ProgramData\'
      -':\Temp\'
      -':\Windows\System32\Tasks\'
      -':\Windows\Tasks\'
      -':\Windows\Temp\'
      -'\AppData\Local\Temp\'

    TargetFilename|endswith: '.sed'
  condition:selection
Falsepositives:
  -Unknown
Level: medium