Hayabusa medium test sigma

ISO or Image Mount Indicator in Recent Files

Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.

View Source

Detection Logic

{
  "file_event": {
    "EventID": 11,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "TargetFilename
| endswith": [
      ".iso.lnk",
      ".img.lnk",
      ".vhd.lnk",
      ".vhdx.lnk"
    ],
    "TargetFilename
| contains": "\\Microsoft\\Windows\\Recent\\"
  },
  "condition": "file_event and selection"
}

False Positives

⚠ Cases in which a user mounts an image file for legitimate reasons

Field Validations

Loading…

Comments (0)

Loading comments...