SLOW#TEMPEST ISO File Distribution
This detection rule identifies the creation of ISO (.iso) files on endpoints, specifically focusing on those created by common internet browsers and email clients. This activity is associated with the SLOW#TEMPEST campaign, which is known to distribute malware payloads via ISO files, often bundled with legitimate applications and malicious DLLs. The rule aims to detect the initial delivery vector of this threat.
Splunk (SPL)
