Hayabusa high test sigma

Phishing Pattern ISO in Archive

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

View Source

Detection Logic

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "ParentImage
| endswith": [
      "\\Winrar.exe",
      "\\7zFM.exe",
      "\\peazip.exe"
    ],
    "Image
| endswith": [
      "\\isoburn.exe",
      "\\PowerISO.exe",
      "\\ImgBurn.exe"
    ]
  },
  "condition": "process_creation and selection"
}

False Positives

⚠ Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction

Field Validations

Loading…

Comments (0)

Loading comments...