Phishing Pattern ISO in Archive

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Known false positives

Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1566` Phishing

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Phishing Pattern ISO in Archive
id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1
status: test
description: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
references:
    - https://twitter.com/1ZRR4H/status/1534259727059787783
    - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/
author: Florian Roth (Nextron Systems)
date: 2022-06-07
tags:
    - attack.initial-access
    - attack.t1566
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\Winrar.exe'
            - '\7zFM.exe'
            - '\peazip.exe'
        Image|endswith:
            - '\isoburn.exe'
            - '\PowerISO.exe'
            - '\ImgBurn.exe'
    condition: selection
falsepositives:
    - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage|endswith:
        - '\Winrar.exe'
        - '\7zFM.exe'
        - '\peazip.exe'
    Image|endswith:
        - '\isoburn.exe'
        - '\PowerISO.exe'
        - '\ImgBurn.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\ImgBurn.exe` `\PowerISO.exe` `\isoburn.exe`	`field:"Image" kind:ends_with`
`ParentImage`	ends_with	`\7zFM.exe` corpus 2 (sigma 2) `\Winrar.exe` corpus 5 (sigma 5) `\peazip.exe`	`field:"ParentImage" kind:ends_with`