LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Expand.exe

View source

Binary that expands one or more compressed files

DownloadCopyADS
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
02DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

Download1

EXAMPLE 01T1105

Copies source file to destination.

COMMAND
expand {PATH_SMB:.bat} {PATH_ABSOLUTE:.bat}
USE CASE
Use to copies the source file to the destination file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Copy1

EXAMPLE 01T1105

Copies source file to destination.

COMMAND
expand {PATH_ABSOLUTE:.source.ext} {PATH_ABSOLUTE:.dest.ext}
USE CASE
Copies files from A to B
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ADS1

EXAMPLE 01T1564.004

Copies source file to destination Alternate Data Stream (ADS)

COMMAND
expand {PATH_SMB:.bat} {PATH_ABSOLUTE}:file.bat
USE CASE
Copies files from A to B
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\Expand.exe
C:\Windows\SysWOW64\Expand.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

2 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Rahmat Nurfauzi@infosecn1nja
Oddvar Moe@oddvarmoe