Sigma medium test sigma

ISO Image Mounted

Detects the mount of an ISO image on an endpoint

View Source

Detection Logic

{
  "selection": {
    "EventID": 4663,
    "ObjectServer": "Security",
    "ObjectType": "File",
    "ObjectName
| startswith": "\\Device\\CdRom"
  },
  "filter_main_generic": {
    "ObjectName": [
      "\\Device\\CdRom0\\autorun.ico",
      "\\Device\\CdRom0\\setup.exe",
      "\\Device\\CdRom0\\setup64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

False Positives

  • ⚠ Software installation ISO files

Field Validations

Loading…

Comments (0)

Loading comments...