detection.wiki

Detection rules › Sigma

ISO Image Mounted

Status
test
Severity
medium
Log source
product windows, service security
Author
Syed Hasan (@syedhasan009)
Source
github.com/SigmaHQ/sigma

Detects the mount of an ISO image on an endpoint

Known false positives

  • Software installation ISO files

MITRE ATT&CK coverage

TacticTechniques
Initial Access

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4663: An attempt was made to access an object.

Rule body

title: ISO Image Mounted
id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073
status: test
description: Detects the mount of an ISO image on an endpoint
references:
    - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
    - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
    - https://twitter.com/MsftSecIntel/status/1257324139515269121
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
author: Syed Hasan (@syedhasan009)
date: 2021-05-29
modified: 2023-11-09
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure'
detection:
    selection:
        EventID: 4663
        ObjectServer: 'Security'
        ObjectType: 'File'
        ObjectName|startswith: '\Device\CdRom'
    filter_main_generic:
        ObjectName:
            - '\Device\CdRom0\autorun.ico'
            - '\Device\CdRom0\setup.exe'
            - '\Device\CdRom0\setup64.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Software installation ISO files
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    EventID: 4663
    ObjectServer: 'Security'
    ObjectType: 'File'
    ObjectName|startswith: '\Device\CdRom'

Stage 2: not filter_main_generic

filter_main_generic:
    ObjectName:
        - '\Device\CdRom0\autorun.ico'
        - '\Device\CdRom0\setup.exe'
        - '\Device\CdRom0\setup64.exe'

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
ObjectNameeq\Device\CdRom0\autorun.icoexcludes:ObjectName field:"ObjectName" value:"\Device\CdRom0\autorun.ico"
ObjectNameeq\Device\CdRom0\setup.exeexcludes:ObjectName field:"ObjectName" value:"\Device\CdRom0\setup.exe"
ObjectNameeq\Device\CdRom0\setup64.exeexcludes:ObjectName field:"ObjectName" value:"\Device\CdRom0\setup64.exe"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ObjectNamestarts_with
  • \Device\CdRom
field:"ObjectName" kind:starts_with value:"\Device\CdRom"
ObjectServereq
  • Security corpus 5 (sigma 5)
field:"ObjectServer" kind:eq value:"Security"
ObjectTypeeq
  • File corpus 10 (sigma 8, splunk 2)
field:"ObjectType" kind:eq value:"File"