ISO File Created Within Temp Folders

Title: ISO File Created Within Temp Folders
Status: test
Description:Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
References:
  -https://twitter.com/Sam0x90/status/1552011547974696960
  -https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
  -https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
Author: @sam0x90
Date: 2022-07-30
modified:None
Tags:

• -'attack.initial-access'
• -'attack.t1566.001'

Logsource:

• category: file_event
• product: windows

Detection:
  selection_1:
    TargetFilename|contains|all:
      -'\AppData\Local\Temp\'
      -'.zip\'

    TargetFilename|endswith: '.iso'
  selection_2:
    TargetFilename|contains: '\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\'
    TargetFilename|endswith: '.iso'
  condition:1 of selection*
Falsepositives:
  -Potential FP by sysadmin opening a zip file containing a legitimate ISO file
Level: high