Skip to content
Threat Feed

Actor

APT37

1 brief RSS
medium threat

Windows Cabinet File Extraction via Expand.exe

Detection of expand.exe being used to extract Microsoft Cabinet (CAB) archives, specifically when extracting to C:\ProgramData or similar staging locations, potentially indicating ingress tool transfer and payload staging by threat actors like APT37.

Splunk Enterprise +2 APT37 cabinet_extraction expand.exe windows endpoint
2r 2t