Log source category

file_executable_detected log source Sigma rules

1 Sigma detection rule in the library use the file_executable_detected log source, mostly on windows. The file_executable_detected category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.

1 rule

Products

windows1

Severity

medium1

Potentially Suspicious Self Extraction Directive File Created
medium
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. Usually ".sed" files are simple ini files and not PE binaries.
windows

Products

Severity

Potentially Suspicious Self Extraction Directive File Created