T1204.002: Execution of Tax_Assessment.exe from Mounted VHDX Volume

Tim Peck@timpeck

•updated Jul 17, 2026•0•0•9

Detects a hidden, non-interactive PowerShell process that programmatically enumerates mounted disk images (VHDX/ISO) using Get-DiskImage or Get-Partition, dismounts them, and potentially deletes the backing files. This behavior is indicative of post-execution cleanup routines used by malware delivered via mounted container images, such as the Overlord RAT.