BINDCLOAK — ISO-mount to multi-stage loader chain

Ankit Mehta@Secvyn

•updated Aug 5, 2026•3•1•6

This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.