{"id":"0248a7bc-8a9a-4cd8-a57e-3ae8e073a073","title":"ISO Image Mounted","description":"Detects the mount of an ISO image on an endpoint","author":"Syed Hasan (@syedhasan009)","status":"test","level":"medium","date":"2021-05-29","modified":"2023-11-09","tags":["attack.initial-access","attack.t1566.001"],"technique_ids":["T1566.001"],"logsource":{"product":"windows","service":"security","definition":"The advanced audit policy setting \"Object Access > Audit Removable Storage\" must be configured for Success/Failure"},"falsepositives":["Software installation ISO files"],"references":["https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore","https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages","https://twitter.com/MsftSecIntel/status/1257324139515269121","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image"],"source_path":"rules/windows/builtin/security/win_security_iso_mount.yml","source_sha256":"92232cd163ff4be6e9ef79b5b107940be52aa0cb51e001d494799e8645df2684","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_iso_mount.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ISO Image Mounted\nid: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073\nstatus: test\ndescription: Detects the mount of an ISO image on an endpoint\nreferences:\n    - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore\n    - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages\n    - https://twitter.com/MsftSecIntel/status/1257324139515269121\n    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image\nauthor: Syed Hasan (@syedhasan009)\ndate: 2021-05-29\nmodified: 2023-11-09\ntags:\n    - attack.initial-access\n    - attack.t1566.001\nlogsource:\n    product: windows\n    service: security\n    definition: 'The advanced audit policy setting \"Object Access > Audit Removable Storage\" must be configured for Success/Failure'\ndetection:\n    selection:\n        EventID: 4663\n        ObjectServer: 'Security'\n        ObjectType: 'File'\n        ObjectName|startswith: '\\Device\\CdRom'\n    filter_main_generic:\n        ObjectName:\n            - '\\Device\\CdRom0\\autorun.ico'\n            - '\\Device\\CdRom0\\setup.exe'\n            - '\\Device\\CdRom0\\setup64.exe'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Software installation ISO files\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1566.001","id":"T1566.001","name":"Spearphishing Attachment","page":"techniques/enterprise/T1566.001/"}],"data_path":"data/detection-rules/0248a7bc-8a9a-4cd8-a57e-3ae8e073a073.json","kind":"sigma"}