Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations. This behavior has been observed in-the-wild by different threat actors.