Suspicious Invoke-Item From Mount-DiskImage

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•3

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.