Binary that expands one or more compressed files
expand c:\ADS\file1.bat c:\ADS\file2.bat
Copies source file to destination.
Copies files from A to B
C:\Windows\System32\Expand.exe, C:\Windows\SysWOW64\Expand.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml, Elastic: https://github.com/elastic/detection-rules/blob/12577f7380f324fcee06dab3218582f4a11833e7/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml
Rahmat Nurfauzi (@infosecn1nja), Oddvar Moe (@oddvarmoe)