anomalous-payload-delivered-from-iso-file

This query looks for lnk file executions from other locations than C: -drive, which can relate to mounted ISO-files. Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-using-mde/