Merge PR #4692 from @jstnk9 - Add new rules related to IExpress abuse

new: New Self Extracting Package Created Via IExpress.EXE
new: Self Extraction Directive File Created In Potentially Suspicious Location
new: Potentially Suspicious Self Extraction Directive File Created
new: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location 
---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

rules-threat-hunting/windows/process_creation/proc_creation_win_iexpress_execution.yml

@@ -0,0 +1,36 @@
+title: New Self Extracting Package Created Via IExpress.EXE
+id: c2b478fc-09bf-40b2-8768-ab3ec8d61c9a
+status: experimental
+description: |
+    Detects the "iexpress.exe" utility creating self-extracting packages.
+    Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
+    Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.
+references:
+    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
+    - https://en.wikipedia.org/wiki/IExpress
+    - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
+    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
+author: Joseliyo Sanchez, @Joseliyo_Jstnk
+date: 2024/02/05
+tags:
+    - attack.execution
+    - attack.t1218
+    - detection.threat_hunting
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_1_parent:
+        ParentImage|endswith: '\iexpress.exe'
+    selection_1_img:
+        - Image|endswith: '\makecab.exe'
+        - OriginalFileName: 'makecab.exe'
+    selection_2_img:
+        - Image|endswith: '\iexpress.exe'
+        - OriginalFileName: 'IEXPRESS.exe'
+    selection_2_cli:
+        CommandLine|contains: ' /n '
+    condition: all of selection_1_* or all of selection_2_*
+falsepositives:
+    - Administrators building packages using iexpress.exe
+level: medium

rules/windows/file/file_event/file_event_win_sed_file_creation.yml

@@ -0,0 +1,36 @@
+title: Self Extraction Directive File Created In Potentially Suspicious Location
+id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f
+related:
+    - id: ab90dab8-c7da-4010-9193-563528cfa347
+      type: derived
+status: experimental
+description: |
+    Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location.
+    These files are used by the "iexpress.exe" utility in order to create self extracting packages.
+    Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
+references:
+    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
+    - https://en.wikipedia.org/wiki/IExpress
+    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
+author: Joseliyo Sanchez, @Joseliyo_Jstnk
+date: 2024/02/05
+tags:
+    - attack.execution
+    - attack.t1218
+logsource:
+    category: file_event
+    product: windows
+detection:
+    selection:
+        TargetFilename|contains:
+            - ':\ProgramData\'
+            - ':\Temp\'
+            - ':\Windows\System32\Tasks\'
+            - ':\Windows\Tasks\'
+            - ':\Windows\Temp\'
+            - '\AppData\Local\Temp\'
+        TargetFilename|endswith: '.sed'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium

rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml

@@ -0,0 +1,30 @@
+title: Potentially Suspicious Self Extraction Directive File Created
+id: ab90dab8-c7da-4010-9193-563528cfa347
+related:
+    - id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f
+      type: derived
+status: experimental
+description: |
+    Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
+    These files are used by the "iexpress.exe" utility in order to create self extracting packages.
+    Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
+    Usually ".sed" files are simple ini files and not PE binaries.
+references:
+    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
+    - https://en.wikipedia.org/wiki/IExpress
+    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
+author: Joseliyo Sanchez, @Joseliyo_Jstnk
+date: 2024/02/05
+tags:
+    - attack.execution
+    - attack.t1218
+logsource:
+    product: windows
+    category: file_executable_detected
+detection:
+    selection:
+        TargetFilename|endswith: '.sed'
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium

rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml

@@ -0,0 +1,39 @@
+title: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
+id: b2b048b0-7857-4380-b0fb-d3f0ab820b71
+status: experimental
+description: |
+    Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
+    This behavior has been observed in-the-wild by different threat actors.
+references:
+    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
+    - https://en.wikipedia.org/wiki/IExpress
+    - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
+    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
+author: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
+date: 2024/02/05
+tags:
+    - attack.execution
+    - attack.t1218
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    # VT Query: behavior_processes:"iexpress.exe" and behavior_processes:"/n /q /m" and behavior_processes:"*.sed*" and p:5+
+    selection_img:
+        - Image|endswith: '\iexpress.exe'
+        - OriginalFileName: 'IEXPRESS.exe'
+    selection_cli:
+        CommandLine|contains: ' /n '
+    selection_paths:
+        CommandLine|contains:
+            # Note: Add more uncommon paths that fit your organizational needs.
+            - ':\ProgramData\'
+            - ':\Temp\'
+            - ':\Windows\System32\Tasks\'
+            - ':\Windows\Tasks\'
+            - ':\Windows\Temp\'
+            - '\AppData\Local\Temp\'
+    condition: all of selection_*
+falsepositives:
+    - Administrators building packages using iexpress.exe
+level: high

tests/logsource.json

@@ -26,6 +26,7 @@
                                 "SourceUser", "TargetImage", "TargetProcessGUID", "TargetProcessId", "TargetUser"],
                 "raw_access_read":["CreationUtcTime", "Image", "ProcessGuid", "ProcessId", "TargetFilename", "User"],
                 "file_event":["ProcessGuid", "ProcessId", "Image", "TargetFilename", "CreationUtcTime", "User"],
+                "file_executable_detected":["ProcessGuid", "ProcessId", "Image", "TargetFilename", "Hashes", "User"],
                 "registry_add":["EventType", "ProcessGuid", "ProcessId", "Image", "TargetObject", "User"],
                 "registry_delete":["Details", "EventType", "Image", "ProcessGuid", "ProcessId", "TargetObject"],
                 "registry_set":["Details", "EventType", "Image", "ProcessGuid", "ProcessId", "TargetObject", "User"],