Suspicious Execution via a Mounted Image File

[rule]
description = """
Identifies the execution of a process from a mounted image file. Attacker may abuse IMG files to deliver malicious
programs.
"""
id = "9401d27c-200a-4d72-ad36-f7051c4b3dcb"
license = "Elastic License v2"
name = "Suspicious Execution via a Mounted Image File"
os_list = ["windows"]
version = "1.0.29"

query = '''
process where event.action == "start" and
 process.parent.executable : "\\Device\\CdRom0\\*" and
 not process.executable : ("?:\\Program Files\\*.exe",
                           "?:\\Program Files (x86)\\*.exe",
                           "\\Device\\CdRom0\\*") and
 not process.code_signature.trusted == true and
 not (process.parent.name : "setup.exe" and process.executable : "?:\\Users\\*\\AppData\\Local\\Temp\\*.tmp\\setup.tmp") and 
 not process.executable : "?:\\WINDOWS\\regtlib.exe" and 
 not process.hash.sha256 :
            ("632c8f0313f35fc45daa4471f9c8c32075156bc696fb20cd19a33a8c760b1297",
             "5b82b27da9bbaae1abc32095942c60017b275e002cbb2c0cb44580131f4789b4",
             "dafb5d89135fa565080c9c6beafbdeb7611089e946a520001a7ef02facb002d3",
             "18d1bae077da62bb5cf5bfa6a6c5c38ac9ade57f098ea2b357fab477e85f1c25",
             "ab9e0291a763efc32e84e7117f9a0fbc99b681c96df0bb27a66433a726667e5c")
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1566"
name = "Phishing"
reference = "https://attack.mitre.org/techniques/T1566/"
[[threat.technique.subtechnique]]
id = "T1566.001"
name = "Spearphishing Attachment"
reference = "https://attack.mitre.org/techniques/T1566/001/"



[threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

[internal]
min_endpoint_version = "7.15.0"