Suspicious Mount-DiskImage Usage for MOTW Bypass

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•25

This rule detects the use of the PowerShell cmdlet 'Mount-DiskImage' with the '-ImagePath' parameter. Adversaries may use this technique to mount disk image files (like ISO or VHD) containing malicious payloads. This method can bypass Mark-of-the-Web (MOTW) controls, as files extracted or accessed from a mounted image may not inherit the MOTW, allowing them to execute without typical security warnings or protections.