Suspicious Extrac32 Execution for File Transfer
This rule detects suspicious execution of 'extrac32.exe' when it is used to download or copy files, specifically cabinet (.cab) files, with common extraction options. Extrac32.exe is a legitimate Windows utility for extracting files from cabinet archives, but it can be abused by adversaries for ingress tool transfer or to stage malicious files.
Sigma
