PowerShell Mount-DiskImage with -ImagePath to Access Disk Images
Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-01
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script content that calls Mount-DiskImage with an -ImagePath parameter. Adversaries can use disk image formats (for example, .iso or .vhd) to deliver or stage payloads in a way that may bypass Mark-of-the-Web tagging. It relies on PowerShell Script Block logging telemetry that captures the script block text containing the specific command-line fragments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Mount-DiskImage with -ImagePath to Access Disk Images
id: 8914eaeb-2d37-4f81-a15f-cf4f4becee70
status: test
description: This rule flags PowerShell script content that calls Mount-DiskImage with an -ImagePath parameter. Adversaries can use disk image formats (for example, .iso or .vhd) to deliver or stage payloads in a way that may bypass Mark-of-the-Web tagging. It relies on PowerShell Script Block logging telemetry that captures the script block text containing the specific command-line fragments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
- https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml
author: frack113, Huntrule Team
date: 2022-02-01
tags:
- attack.defense-impairment
- attack.t1553.005
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- "Mount-DiskImage "
- "-ImagePath "
condition: selection
falsepositives:
- Legitimate PowerShell scripts
level: low
license: DRL-1.1
related:
- id: 29e1c216-6408-489d-8a06-ee9d151ef819
type: derived