Phish - ISO Mount to Payload Execution Sequence (T1553.005)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Maps the behavioral sequence of a user mounting an ISO/IMG file (which bypasses MOTW) and subsequently executing a payload originating from the new virtual drive.