JUST RELEASED: ATT&CK for Industrial Control Systems


Expand is a Windows utility used to expand one or more compressed CAB files.[1] It has been used by BBSRAT to decompress a CAB file into executable content.[2]

ID: S0361
Type: TOOL
Platforms: Windows
Contributors: Matthew Demaske, Adaptforward
Version: 1.0
Created: 19 February 2019
Last Modified: 19 April 2019

Techniques Used

Domain ID Name Use
Enterprise T1140 Deobfuscate/Decode Files or Information

Expand can be used to decompress a local or remote CAB file into an executable.[1]

Enterprise T1096 NTFS File Attributes

Expand can be used to download or copy a file into an alternate data stream.[3]

Enterprise T1105 Remote File Copy

Expand can be used to download or upload a file over a network share.[3]