Suspicious PowerShell Invoke-Item After Mount-DiskImage From Mounted Drive Letter

Flags PowerShell that mounts an image, derives a drive letter, then runs content via invoke-item from that mount.

FreeUnreviewedSigmamediumv1

suspicious-powershell-invoke-item-after-mount-diskimage-from-mounted-drive-lette-902cedee

title: Suspicious PowerShell Invoke-Item After Mount-DiskImage From Mounted Drive Letter
id: bab0bb82-d9d4-4765-ba60-e12c5577b338
status: test
description: This rule identifies PowerShell script block content that mounts a disk image using Mount-DiskImage with an ImagePath, captures the mounted drive letter via Get-Volume, and then executes content from that drive using invoke-item. Attackers may use this pattern to launch payloads delivered inside container files such as ISOs or VHDs, potentially bypassing markers like MOTW. It relies on Script Block Logging telemetry that records the matching PowerShell commands and parameters within a single script block.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso
  - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml
author: frack113, Huntrule Team
date: 2022-02-01
tags:
  - attack.defense-impairment
  - attack.t1553.005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Mount-DiskImage "
      - "-ImagePath "
      - Get-Volume
      - .DriveLetter
      - "invoke-item "
      - ):\
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
  - id: 902cedee-0398-4e3a-8183-6f3a89773a96
    type: derived

What it detects

This rule identifies PowerShell script block content that mounts a disk image using Mount-DiskImage with an ImagePath, captures the mounted drive letter via Get-Volume, and then executes content from that drive using invoke-item. Attackers may use this pattern to launch payloads delivered inside container files such as ISOs or VHDs, potentially bypassing markers like MOTW. It relies on Script Block Logging telemetry that records the matching PowerShell commands and parameters within a single script block.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.