ISO or Image Mount Indicator in Recent Files
Detects the creation of recent file shortcuts (.lnk) that point to disk image files (.iso, .img, .vhd, .vhdx). This activity is often observed in phishing attacks where adversaries use these file types to deliver malware. The rule specifically looks for these shortcuts within the 'Recent' folder of a user's profile, indicating that the user has recently interacted with such a file.
Sigma
