tool

Expand S0361

Type: tool
Platform: Windows
Created: 19 February 2019
Last modified: 25 April 2025

Expand is a Windows utility used to expand one or more compressed CAB files.[1] It has been used by BBSRAT to decompress a CAB file into executable content.[2]

TechniquesBottom 12%

TacticsBottom 12%

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0361

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects execution from an Alternate Data Stream (ADS). (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113	2021-09-01	2022-10-09	7f43c430-5001-4f8b-aaa9-c3b88f18fa5c
	Exports the target Registry key and hides it in the specified alternate data stream.	Generic	test	create_stream_hash	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	high	Oddvar Moe, Sander Wiebing, oscd.community	2020-10-07	2021-11-27	0d7a9363-af70-4e7b-a3b7-1a176b7fbe84
	Detects the creation of a named file stream with the imphash of a well-known hack tool	Generic	test	create_stream_hash	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	high	Florian Roth (Nextron Systems)	2022-08-24	2024-11-23	19b041f6-e583-40dc-b842-d6fa8011493f
	Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a n (...)	Generic	test	create_stream_hash	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	medium	Florian Roth (Nextron Systems), @0xrawsec	2018-06-03	2023-02-10	b69888d4-380c-45ce-9cf9-d9ce46e67821
	Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. (...)	Generic	test	process_creation	macos	-	Stealth Hide Artifacts NTFS File Attributes Command and Control Ingress Tool Transfer Stealth System Binary Proxy Execution Credential Access Unsecured Credentials Credentials In Files	-	medium	Omar Khaled (@beacon_exe)	2024-08-21	—	3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
	Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes Command and Control Ingress Tool Transfer Stealth System Binary Proxy Execution Credential Access Unsecured Credentials Credentials In Files	-	low	Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)	2020-10-05	2024-03-05	04936b66-3915-43ad-a8e5-809eadfd1141
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Unsupported	unsupported	service	windows	WinEventLog System	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-03-21	1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Generic	test	service	windows	WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-10-05	6fb63b40-e02a-403e-9ffd-3bcc1d749442
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
	Detects writing data into NTFS alternate data streams from powershell. (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Stealth Hide Artifacts NTFS File Attributes	-	high	Sami Ruohonen	2018-07-24	2022-12-25	8c521530-5169-495d-a199-0a3a881ad24e
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	Detects the creation of hidden file/folder with the "::$index_allocation" stream. (...)	Generic	test	file_event	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	medium	Scoubi (@ScoubiMtl)	2023-10-09	—	a8f866e1-bdd4-425e-a27a-37619238d9c7
	Detects command line containing reference to the "::$index_allocation" stream, which can be used as (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)	2023-10-09	—	0900463c-b33b-49a8-be1d-552a3b553dae
	Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	high	Harjot Singh, '@cyb3rjy0t'	2023-01-21	2026-03-16	9248c7e1-2bf3-4661-a22c-600a8040b446
	Detects the creation of potentially suspicious files by OpenEDR's ITSMService process. (...)	Generic	experimental	file_event	windows	Sysmon	Command and Control Ingress Tool Transfer Lateral Movement Lateral Tool Transfer Command and Control Remote Access Tools	-	medium	@kostastsale	2026-02-19	—	9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
	Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information	-	high	Florian Roth (Nextron Systems)	2019-08-24	2023-04-06	fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
	A General detection for specific decompress commands in PowerShell logs. (...)	Generic	test	ps_module	windows	PowerShell	Stealth Deobfuscate/Decode Files or Information	-	informational	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2022-12-25	1ddc1472-8e52-4f7d-9f11-eab14fc171f5
	Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.	Generic	test	ps_script	windows	PowerShell	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113	2021-09-02	2022-12-25	a699b30e-d010-46c8-bbd1-ee2e26765fe9
	Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes Command and Control Ingress Tool Transfer	-	high	frack113	2022-05-02	—	cafeeba3-01da-4ab4-b6c4-a31b1d9730c7
	Detects creation of the PSEXEC key file. (...)	Generic	test	file_event	windows	Sysmon	Persistence Create Account Domain Account Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Lateral Tool Transfer	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-21	2023-02-23	304afd73-55a5-4bb9-8c21-0b1fc84ea9e4
	Detects execution of "findstr" with specific flags and a remote share path. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes Command and Control Ingress Tool Transfer Stealth System Binary Proxy Execution Credential Access Unsecured Credentials Credentials In Files	-	medium	Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)	2020-10-05	2024-03-05	587254ee-a24b-4335-b3cd-065c0f1f4baa
	Detects PowerShell script execution from Alternate Data Stream (ADS)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	high	Sergey Soldatov, Kaspersky Lab, oscd.community	2019-10-30	2022-07-14	45a594aa-1fbd-4972-a809-ff5a99dd81b8
	Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-31	2023-02-28	5bb68627-3198-40ca-b458-49f973db8752
	Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Lateral Tool Transfer	-	medium	frack113	2023-07-21	—	2238d337-42fb-4971-9a68-63570f2aede4
	Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enter (...)	Hunting	test	ps_script	windows	PowerShell	Lateral Movement Lateral Tool Transfer	-	medium	frack113	2023-07-21	—	6df07c3b-8456-4f8b-87bb-fe31ec964cae
	Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113	2021-11-26	2022-12-31	6b369ced-4b1d-48f1-b427-fdc0de0790bd
	Extract data from cab file and hide it in an alternate data stream	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113	2021-11-26	2022-12-30	4b13db67-0c45-40f1-aba8-66a1a7198a1e
	Detects the download of suspicious file type from a well-known file and paste sharing domain	Generic	test	create_stream_hash	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	high	Florian Roth (Nextron Systems)	2022-08-24	2026-03-29	52182dfb-afb7-41db-b4bc-5336cb29b464
	Detects suspicious rules that delete or move messages or folders are set on a user's inbox.	Generic	test	-	-	Azure Risk Detection · Azure	Stealth Deobfuscate/Decode Files or Information	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	ceb55fd0-726e-4656-bf4e-b585b7f7d572
	Detects presence of a potentially xor encoded powershell command	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	medium	Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali	2018-09-05	2023-01-30	bb780e0c-16cf-4383-8383-1e5471db6cf9
	Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60d050c4-e253-4d9a-b673-5ac100cfddfb
	Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	23835beb-ec38-4e74-a5d4-b99af6684e91
	Detects the execution of "openssl" to connect to an IP address. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60911c07-f989-4362-84af-c609828ef829
	Detects the download of suspicious file type from URLs with IP	Generic	test	create_stream_hash	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	high	Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)	2022-09-07	2023-02-10	025bd229-fd1f-4fdb-97ab-20006e1a5368
	Detects the download of suspicious file type from a well-known file and paste sharing domain	Generic	test	create_stream_hash	windows	Sysmon	Stealth Hide Artifacts NTFS File Attributes	-	medium	Florian Roth (Nextron Systems)	2022-08-24	2026-03-29	ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
	Detect use of the Windows 8.3 short name. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-08-05	2022-09-21	dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795
	Detect use of the Windows 8.3 short name. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-08-06	2023-07-20	3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b
	Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113, Nasreddine Bencherchali	2022-08-07	2025-10-22	349d891d-fef0-4fe4-bc53-eee623a15969
	Detect use of the Windows 8.3 short name. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts NTFS File Attributes	-	medium	frack113, Nasreddine Bencherchali	2022-08-07	2025-10-20	a96970af-f126-420d-90e1-d37bf25e50e1

Title

Description

Expand S0361

Expand MITRE reference S0361

Standing S0361

Reach

Coverage

Expand detections S0361