Phishing Pattern: ISO in Archive Opened by Archiver

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•13

Detects cases where an ISO file is opened within an archiving application like 7-Zip or WinRAR. This behavior is often associated with phishing campaigns where threat actors embed small ISO files in archives as email attachments to bypass security filters and protective measures (e.g., Mark-of-the-Web).