BIOC
Informational
✕
ISO mounted manually
A user manually mounted an ISO file.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Hide Artifacts: Hidden Files and Directories (T1564.001)
Indicator:
File file name = *.iso.lnk AND file path = *\appdata\roaming\microsoft\windows\recent\* AND action type = create Process initiated by = explorer.exe , cgo name = explorer.exe , os parent name = explorer.exe
Preventable: yes