Windows PowerShell: Suspicious Invoke-Item After Mount-DiskImage
Flags PowerShell that mounts an image, derives a drive letter, then runs content via invoke-item from that mount.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-01
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script blocks that mount a disk image using Mount-DiskImage with an ImagePath, retrieve the mounted drive letter via Get-Volume, and then run content from that drive using invoke-item. Attackers may chain these actions to execute payloads from container files that may not be properly marked with MOTW, aiding defense-impairment and execution from non-native sources. It relies on Script Block logging telemetry to capture the combined use of Mount-DiskImage, Get-Volume, .DriveLetter, and invoke-item within a single script block.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: Suspicious Invoke-Item After Mount-DiskImage"
id: bab0bb82-d9d4-4765-ba60-e12c5577b338
status: test
description: This rule flags PowerShell script blocks that mount a disk image using Mount-DiskImage with an ImagePath, retrieve the mounted drive letter via Get-Volume, and then run content from that drive using invoke-item. Attackers may chain these actions to execute payloads from container files that may not be properly marked with MOTW, aiding defense-impairment and execution from non-native sources. It relies on Script Block logging telemetry to capture the combined use of Mount-DiskImage, Get-Volume, .DriveLetter, and invoke-item within a single script block.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso
- https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml
author: frack113, Huntrule Team
date: 2022-02-01
tags:
- attack.defense-impairment
- attack.t1553.005
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- "Mount-DiskImage "
- "-ImagePath "
- Get-Volume
- .DriveLetter
- "invoke-item "
- ):\
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: medium
license: DRL-1.1
related:
- id: 902cedee-0398-4e3a-8183-6f3a89773a96
type: derived