ISO File in Temp Folder (Windows Event Log)

id: '23357.42539'
title: ISO File in Temp Folder
description: Threat actors may rely upon a user opening a malicious file in order
  to gain execution. Users may be subjected to social engineering to get them to open
  a file that will lead to code execution. This use case detects file events involving
  AppData Temp folder locations involving zip and ISO files, as observed with Qakbot
  from end of July 2022. Event 4656 and/or 4663 are required for detection. To specifically
  audit file creations, enable object access auditing and configure auditing on the
  directories \AppData\Local\Temp and AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4656) OR
  "<EventID>4656<" OR TERM(EventCode=4663) OR "<EventID>4663<") ("\\AppData\\Local\\Temp"
  OR "\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content\\Outlook") ".zip" ".iso"
  | where match(process_path, "(?i)(\x5cAppData\x5cLocal\x5cMicrosoft\x5cWindows\x5cINetCache\x5cContent\.Outlook|\x5cAppData\x5cLocal\x5cTemp).*\.zip\x5c")
  and match(ObjectName, "(?i)\.iso($|\")") | table _time, host, user, signature_id,
  process, process_*, parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:user execution:malicious file
technique_id:
- T1204.002
data_category:
- Windows event logs
references:
- https://www.microsoft.com/en-us/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/