Name:Windows ISO LNK File Creation id:d7c2c09b-9569-4a9e-a8b6-6a39a99c1d32 version:4 date:2024-10-17 author:Michael Haag, Teoderick Contreras, Splunk status:production type:Hunting Description:The following analytic detects the creation of .iso.lnk files in the %USER%\AppData\Local\Temp\<random folder name>\ path, indicating that an ISO file has been mounted and accessed. This detection leverages the Endpoint.Filesystem data model, specifically monitoring file creation events in the Windows Recent folder. This activity is significant as it may indicate the delivery and execution of potentially malicious payloads via ISO files. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further system compromise. Data_source:
-Sysmon EventID 11
search:| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\Microsoft\\Windows\\Recent\\*") Filesystem.file_name IN ("*.iso.lnk", "*.img.lnk", "*.vhd.lnk", "*vhdx.lnk") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_iso_lnk_file_creation_filter`
how_to_implement:To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives:False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed. References: -https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ -https://github.com/MHaggis/notes/blob/master/utilities/ISOBuilder.ps1 -https://isc.sans.edu/diary/Recent+AZORult+activity/25120 -https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html drilldown_searches:
: tags: analytic_story: - 'Spearphishing Attachments' - 'Brute Ratel C4' - 'AgentTesla' - 'Qakbot' - 'IcedID' - 'Azorult' - 'Remcos' - 'Warzone RAT' - 'Amadey' - 'Gozi Malware' asset_type:Endpoint confidence:50 impact:80 message:An ISO file was mounted on $dest$ and should be reviewed and filtered as needed. mitre_attack_id: - 'T1566.001' - 'T1566' - 'T1204.001' - 'T1204' observable: name:'dest' type:'Hostname' - role: - 'Victim' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - 'Filesystem.file_create_time' - 'Filesystem.process_id' - 'Filesystem.file_name' - 'Filesystem.file_path' - 'Filesystem.dest' risk_score:40 security_domain:endpoint
