Sigma rule: ISO Image Mounted

Rule

Title

ISO Image Mounted

Status

test

Level

medium

Author

Syed Hasan (@syedhasan009)

Date

2021-05-29

Modified

2023-11-09

File

rules/windows/builtin/security/win_security_iso_mount.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the mount of an ISO image on an endpoint

Log source

product

windows

service

security

definition

The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure

Detection

selection:
    EventID: 4663
    ObjectServer: 'Security'
    ObjectType: 'File'
    ObjectName|startswith: '\Device\CdRom'
filter_main_generic:
    ObjectName:
        - '\Device\CdRom0\autorun.ico'
        - '\Device\CdRom0\setup.exe'
        - '\Device\CdRom0\setup64.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Software installation ISO files

Tags

• attack.initial-access
• attack.t1566.001

MITRE ATT&CK ids this rule names

• T1566.001

References

• https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
• https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
• https://twitter.com/MsftSecIntel/status/1257324139515269121
• https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/security/win_security_iso_mount.yml