Suspicious Execution from Mounted Virtual Disk Image

Tun Tun Naing@tuntun

•updated yesterday•6•0•22

Detects executable files launched from mounted ISO, IMG, VHD, or VHDX images and correlates the activity with DLL side-loading, outbound public network connections, suspicious executable naming patterns, and the possible delivery source such as WhatsApp or Internet download.