Suspicious Invoke-Item From Mounted Disk Image

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•23

This rule detects suspicious PowerShell activity involving the mounting of a disk image (like ISO or VHD) and then immediately invoking an item from that mounted image. This technique is often used by adversaries to bypass Mark-of-the-Web (MOTW) protections, as files extracted or run from mounted disk images may not inherit the MOTW flag, allowing malicious payloads to execute without security warnings.