Potentially Suspicious Cabinet File Expansion by expand.exe

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•0•18

Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.