Self Extraction Directive File Created In Potentially Suspicious Location

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.