Execution from a Downloaded ISO File

sequence with maxspan=5m
 [file where event.action != "deletion" and file.extension : ("ISO", "IMG") and
  (
    file.path : ("?:\\Users\\*\\Downloads\\*",
                 "?:\\Users\\*\\Content.Outlook\\*",
                 "?:\\Users\\*\\AppData\\Local\\Temp\\Temp?_*") or
    file.name : "*:Zone.Identifier" or
    file.Ext.windows.zone_identifier > 1
   ) and
   not process.executable : "?:\\Windows\\System32\\dllhost.exe"
  ]
 [process where event.action == "start" and
  process.parent.name : ("explorer.exe", "cmd.exe", "powershell.exe") and 
  process.working_directory : "?:\\" and 

  /* execution from mounted ISO file */
  (process.executable : "\\Device\\CdRom*" or (process.executable : "?:\\*" and not process.executable : "?:\\*\\*")) and

  not (process.pe.original_file_name : ("setup.exe", "SqlSetupBootstrapper.exe") and process.code_signature.trusted == true)
  ]