ISO Image Mounted

Title: ISO Image Mounted
Status: test
Description:Detects the mount of an ISO image on an endpoint
References:
  -https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
  -https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
  -https://twitter.com/MsftSecIntel/status/1257324139515269121
  -https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
Author: Syed Hasan (@syedhasan009)
Date: 2021-05-29
modified:2023-11-09
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure

Detection:
  selection:
    EventID: '4663'
    ObjectServer: 'Security'
    ObjectType: 'File'
    ObjectName|startswith: '\Device\CdRom'
  filter_main_generic:
    ObjectName:
      -'\Device\CdRom0\autorun.ico'
      -'\Device\CdRom0\setup.exe'
      -'\Device\CdRom0\setup64.exe'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Software installation ISO files
Level: medium