ISO Image Mounted
This rule detects when an ISO image is mounted on a Windows endpoint. It specifically looks for Event ID 4663 (An attempt was made to access an object) where the ObjectServer is 'Security', ObjectType is 'File', and the ObjectName starts with '\Device\CdRom'. The rule filters out common legitimate files found on mounted ISOs, such as 'autorun.ico', 'setup.exe', and 'setup64.exe', to reduce false positives. This activity can be indicative of an adversary using ISO images to bypass Mark-of-the-Web (MOTW) protections and deliver malicious payloads.
Sigma
