Browse Rules

info_file_iso_mounted

Mount an ISO file

info_file_iso_written

ISO file write event

[SOPHOS] Computer has been isolated

[SOPHOS] Computer has been isolated

ISO Image Mounted

Detects the mount of an ISO image on an endpoint

ISO Image Mounted

Detects the mount of an ISO image on an endpoint

List Device Isolations

This query lists all the device isolation activities that have been performed by Defender For Endpoint. It is good practice to review those once every x period. The query extracts multiple events from the isolation action, ssuch as which device is isolated, what isolation comment has been used and the type of isolation that has been executed.

[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success

[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success

[CISCO-SECUREENDPOINT] Endpoint Isolation Stop Success

[CISCO-SECUREENDPOINT] Endpoint Isolation Stop Success

trojan_win_bbtok_iso_sep23 [yara_rules]

Finds BBTok installation ISO file

MAL_CRIME_Unknown_ISO_Jun21_1 [yara]

Triggers on ISO files that mimick NOBELIUM TTPs, but uses LNK files that call powershell instead.

Execution from a Downloaded ISO File

Identifies the execution of a process from a downloaded ISO file. Attacker may abuse ISO files to deliver malicious programs.

Device Removed From Isolation

This query lists all the devices that are removed from isolation activities that have been performed by Defender For Endpoint. It is good practice to review those once every x period. The query extracts multiple events from the removal action, such as which device is isolated, what isolation comment has been used and the type of isolation that has been executed. The removal action is enriched with the original isolation information to return an overview of why the device has been isolated, by wh

ISO LNK Infection Chain

Detection of an ISO download followed by a child-process of explorer, which is characteristic of an infection using an ISO containing an LNK file.

List inboxes that recieved an ISO attachment

Adversaries may use ISO files as email attachment to trick users into opening those malicious files. Trend Micro has done reaches on spam campgains that use ISO image files to deliver Lokibot and NanoCore malware onto victems devices. Recieving the ISO does not mean that the user is infected, depending on the malware, the user is mostly only infected after the ISO has been mapped or if files on the ISO have been opened. This query detects all inbound emails that contain a ISO image. By default

Attachment: HTML smuggling with embedded base64-encoded ISO

HTML attachment contains a base-64 encoded ISO. This is a known TTP for multiple threat actors.

Suspicious ImageLoad from an ISO Mounted Device

Identifies instances of RunDLL32, Regsvr32 or Odbcconf loading a DLL from a mounted ISO device. Adversaries may deliver a malicious payload via an ISO file and execute it via rundll32.exe, regsvr32 or Odbcconf.

ISO LNK Infection Chain

Detection of an ISO (or any other similar archive file) downloaded file, followed by a child-process of explorer, which is characteristic of an infection using an ISO containing an LNK file. For events with `host.name`.

Phishing Pattern ISO in Archive

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Phishing Pattern ISO in Archive

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

SUSP_ZIP_ISO_PhishAttachment_Pattern_Jun22_1 [yara]

Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks

Phishing Pattern ISO in Archive

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

ISO or Image Mount Indicator in Recent Files

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

ISO or Image Mount Indicator in Recent Files

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

Hunt for rare ISO files on devices

Adversaries may use ISO files to obfuscate their malicious intentions and gain initail access. Those files may be send via mail. A common Actor that sends ISO attachments is Lokibot. To reduce the attack surface consider disabling auto mounting of disk images. This hunting query lets you search for rare ISO files in your organisation. The threshold for the query is that the ISO file has a global prevalence of less then 100, this can be adjusted to your needs. This query does not look for mounted

ISO File Created Within Temp Folders

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.