ISO Image Mounted

calendar Nov 10, 2023 · attack.initial_access attack.t1566.001  ·
Share on: linkedin copy

Detects the mount of an ISO image on an endpoint

Sigma rule (View on GitHub)

 1title: ISO Image Mounted
 2id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073
 3status: test
 4description: Detects the mount of an ISO image on an endpoint
 5references:
 6    - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
 7    - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
 8    - https://twitter.com/MsftSecIntel/status/1257324139515269121
 9    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
10author: Syed Hasan (@syedhasan009)
11date: 2021/05/29
12modified: 2023/11/09
13tags:
14    - attack.initial_access
15    - attack.t1566.001
16logsource:
17    product: windows
18    service: security
19    definition: 'The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure'
20detection:
21    selection:
22        EventID: 4663
23        ObjectServer: 'Security'
24        ObjectType: 'File'
25        ObjectName|startswith: '\Device\CdRom'
26    filter_main_generic:
27        ObjectName:
28            - '\Device\CdRom0\autorun.ico'
29            - '\Device\CdRom0\setup.exe'
30            - '\Device\CdRom0\setup64.exe'
31    condition: selection and not 1 of filter_main_*
32falsepositives:
33    - Software installation ISO files
34level: medium

References

Related rules

to-top