Suspicious PowerShell Mount-DiskImage Using -ImagePath Parameter (Windows)

Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.

FreeUnreviewedSigmalowv1

suspicious-powershell-mount-diskimage-using-imagepath-parameter-windows-29e1c216

title: Suspicious PowerShell Mount-DiskImage Using -ImagePath Parameter (Windows)
id: 8914eaeb-2d37-4f81-a15f-cf4f4becee70
status: test
description: This rule flags PowerShell script blocks that contain a call to Mount-DiskImage with an -ImagePath argument. Attackers can use disk image formats (e.g., ISO/VHD) to stage or deliver payloads in a way that may evade Mark-of-the-Web tagging. It relies on Script Block Logging telemetry to match the presence of the Mount-DiskImage and -ImagePath strings within executed PowerShell content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
  - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml
author: frack113, Huntrule Team
date: 2022-02-01
tags:
  - attack.defense-impairment
  - attack.t1553.005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - "Mount-DiskImage "
      - "-ImagePath "
  condition: selection
falsepositives:
  - Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
  - id: 29e1c216-6408-489d-8a06-ee9d151ef819
    type: derived

What it detects

This rule flags PowerShell script blocks that contain a call to Mount-DiskImage with an -ImagePath argument. Attackers can use disk image formats (e.g., ISO/VHD) to stage or deliver payloads in a way that may evade Mark-of-the-Web tagging. It relies on Script Block Logging telemetry to match the presence of the Mount-DiskImage and -ImagePath strings within executed PowerShell content.

Known false positives

Legitimate PowerShell scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.