CmdID

CmdID / Commands

iexpress

Create self-extracting archive executable (.exe) or cabinet (.cab) files. tldr-pages

On Windows 2 Sigma rules name it File iexpress.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Build a self-extracting ZIP archive from a given SED file

iexpress /n path\to\file.sedIdentify

Trips 1 Sigma rule: mediumNew Self Extracting Package Created Via IExpress.EXE by Joseliyo Sanchez, @Joseliyo_Jstnk

Run the build process in a minimized window

iexpress /n /m path\to\file.sedIdentify

Trips 1 Sigma rule: mediumNew Self Extracting Package Created Via IExpress.EXE by Joseliyo Sanchez, @Joseliyo_Jstnk

Run the build process in a quiet mode, assuming the user account invoking this command as an administrator or regular user

iexpress /n /q:a path\to\file.sedIdentify

Trips 1 Sigma rule: mediumNew Self Extracting Package Created Via IExpress.EXE by Joseliyo Sanchez, @Joseliyo_Jstnk

Ensure the .exe file to ask, never, or always restart the computer after installation

iexpress /r:a path\to\file.sedIdentify

What detects it

Sigma process creation rules that name iexpress
highSelf Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious LocationJoseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
mediumNew Self Extracting Package Created Via IExpress.EXEJoseliyo Sanchez, @Joseliyo_Jstnk