Suspicious Mount-DiskImage

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•2•0•2

Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.