Ceplin Command Identifier

Identifier / Programs / Windows

expand.exe

Expands one or more compressed files. Windows commands reference

LOLBAS Download, Copy, ADS 1 Sigma rule name it 2 ATT&CK techniques 3 documented commands 12 known copies with hashes

Opens the identifier with your command. It is read in your browser and sent nowhere.

How expand.exe is abused

documented by LOLBAS

Download T1105 Ingress Tool Transfer

Copy T1105 Ingress Tool Transfer

ADS T1564.004 Hide Artifacts: NTFS File Attributes

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for expand.exe.

3 documented commands

from LOLBAS, each read by the identifier

Download T1105 Ingress Tool Transfer User privileges

Copies source file to destination.

expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}
Identify

Copy T1105 Ingress Tool Transfer User privileges

Copies source file to destination.

expand {PATH_ABSOLUTE:.source.ext} {PATH_ABSOLUTE:.dest.ext}
Identify

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Copies source file to destination Alternate Data Stream (ADS)

expand {PATH_SMB:.bat} {PATH_ABSOLUTE}:file.bat
Identify

None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for expand.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for expand.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules
mediumPotentially Suspicious Cabinet File ExpansionBhabesh Raj, X__Junior (Nextron Systems)
T1105Ingress Tool Transfer
T1564.004Hide Artifacts: NTFS File Attributes

Is it the real expand.exe?

file version info and known copies
Original nameexpand in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionLZ Expansion Utility

12 known copies

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\expand.exe · not signed

08f770e31ae7bc785959e1dfe7d50008d828c2a470379f69eb613192a25f3b2d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\expand.exe · not signed

f6c58fd43d203ece69a80f8dad51b85188bd138200cf2834798d7c5de950564b

5.00 (rs1_release.160715-1616) · C:\Windows\SysWOW64\expand.exe · signed by Microsoft Windows

8082b8a2ce8dfca365a669ce94c439e91d2d5291a513702c0fc93273f2cf9c9c

5.00 (rs1_release.160715-1616) · C:\Windows\system32\expand.exe · signed by Microsoft Windows

83ea7a5c7634eea15f4460417658120e1b2fc2c706b0d3468231fd47266086fc

5.00 (WinBuild.160101.0800) · C:\Windows\system32\expand.exe · signed by Microsoft Windows

210a43646b58a60035cedc30281f3414dd6a551a62255aac7ef828c5d7ea46ce

5.00 (WinBuild.160101.0800) · C:\Windows\system32\expand.exe · signed by Microsoft Windows

3d263df4d7ab8b2b408713ed42b87ec355e33617b8b8249fcbd8be52d1a50f25

5.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\expand.exe · signed by Microsoft Windows

3d5bd1fd4ce50c491af6a82a764c39028063b95f25c954092fff54c60fa57cf9

5.00 (WinBuild.160101.0800) · C:\WINDOWS\system32\expand.exe · signed by Microsoft Windows

71d931442aa51e3fecb3c014d189e9125e210507ba8acf8abe83e5c9f6810fe2

5.00 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\expand.exe · signed by Microsoft Windows

c6c01c49639c66994b47afb78b4af76166ccb4d823f5fd25a657d9bbf6398b04

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\expand.exe · signed by Microsoft Windows

dfc1709a2988301f7a9d145fb107793e3299ecc85f4b9702523939e35573ab85

5.00 (WinBuild.160101.0800) · C:\Windows\SysWOW64\expand.exe · signed by Microsoft Windows

f8603f7e5e3158e5e381854e1036781269c56a7671555628ab20c1102640ac3f

5.00 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\expand.exe · signed by Microsoft Windows

fac091fdd81d75056cb923a6781e6ccf70693ed7a45cc260ad8b6f29c41d7a71

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Uncompress a single-file Cabinet file to the specified directory

expand path\to\file.cab path\to\directoryIdentify

Display the list of files in a source Cabinet file

expand path\to\file.cab path\to\directory -dIdentify
-dDisplays a list of files in the source location. Windows commands reference

Uncompress all files from the Cabinet file

expand path\to\file.cab path\to\directory -f:*Identify
-fSpecifies the files in a cabinet (.cab) file that you want to expand. Windows commands reference

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.

Options

5 in Windows commands reference
Show every option of expand.exe
-rRenames expanded files.
-iRenames expanded files but ignores the directory structure.
-dDisplays a list of files in the source location.
-fSpecifies the files in a cabinet (.cab) file that you want to expand.
/?Displays help at the command prompt.

Other programs abused for Download

appinstaller.exe · bcp.exe · bitsadmin.exe · certoc.exe · certreq.exe · certutil.exe · cmd.exe · cmdl32.exe · configsecuritypolicy.exe · desktopimgdownldr.exe · devtunnel.exe · diantz.exe · ecmangen.exe · esentutl.exe · excel.exe · extrac32.exe