Suspicious ISO Mount Activity

Luís Marques@remotecodeexecution

•updated today•0•0•0

Detects the execution of PowerShell cmdlets used to mount ISO/VHD images. This behavior is a known prerequisite for the RoguePlanet Windows Defender vulnerability exploit, which relies on a race condition triggered during the mounting of an ISO image by a standard user.