New Self-Extracting Package Created Via IExpress.EXE
Detects the "iexpress.exe" utility creating self-extracting packages. Attackers are known to leverage "iexpress" to compile packages on the fly via ".sed" files. This rule specifically looks for iexpress.exe either launching makecab.exe or iexpress.exe itself being launched with the '/n' command line argument, which is indicative of creating a new self-extracting package.
Sigma
