Self-Extracting Package Creation Via Iexpress.exe From Suspicious Location
This rule detects the creation of self-extracting packages using iexpress.exe when the Self Extraction Directive (SED) file is located in potentially suspicious directories such as ProgramData, Temp, or Windows Tasks folders. This activity has been observed in-the-wild by various threat actors for defense evasion and payload delivery.
Sigma
