Potentially Suspicious Self Extraction Directive File Created

Title: Potentially Suspicious Self Extraction Directive File Created
Status: test
Description:Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.
References:
  -https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  -https://en.wikipedia.org/wiki/IExpress
  -https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-02-05
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• product: windows
• category: file_executable_detected

Detection:
  selection:
    TargetFilename|endswith: '.sed'
  condition:selection
Falsepositives:
  -Unknown
Level: medium