Suspicious Extrac32 Archive Extraction from User-Writable Locations
Detects the use of the living-off-the-land binary (LOLBIN) extrac32.exe to decompress cabinet (.cab) or .vstm files from user-writable locations. This technique is used by loaders like CastleLoader to unpack malicious stages.
Microsoft Sentinel (KQL)
