Self Extraction Directive File Created In Suspicious Location
Detects the creation of Self Extraction Directive (.sed) files in suspicious locations. These files are used by the 'iexpress.exe' utility to create self-extracting packages. Adversaries have been observed abusing this utility to create PE files with embedded .sed entries, often as a defense evasion technique.
Sigma
