ISO Image Mounted - Windows (Windows Event Log)

id: '20231.35920'
title: ISO Image Mounted - Windows
description: 'Threat actors such as APT29 have used ISO files to deliver malicious
  code to target systems. Normally, when a file is downloaded from the internet, Windows
  adds a Zone Identifier to identify the file''s origin (known as mark-of-the-web
  or MOTW). Files stored with an ISO do not contain the Zone Identifier Alternate
  Data Stream, enabling MOTW bypass. This use case detects ISO images mounted on Windows
  systems. -- Threat Actor Association: Lazarus -- Atomics T1553.005 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4663) OR
  "<EventID>4663<") "Device\\CdRom" | where match(file_path, "(?i)\x5cDevice\x5cCdRom")
  and not match(file_path, "\x5cDevice\x5cCdRom0\x5csetup\.exe")| table _time, host,
  user, process, process_*, parent_process_* | bin span=1s | stats values(*) as *
  by _time, host '
techniques:
- defense-evasion:subvert trust controls:mark-of-the-web bypass
- execution:user execution:malicious file
technique_id:
- T1553.005
- T1204.002
data_category:
- Windows event logs
references:
- https://www.mandiant.com/resources/blog/tracking-apt29-phishing-campaigns
- https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
- https://www.cybereason.com/blog/cybereason-vs.-quantum-locker-ransomware
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image