Windows ISO File Creation in User Temporary Folders

title: Windows ISO File Creation in User Temporary Folders
id: 7920e8a9-da9d-42c2-ba2f-bb5f637407c3
status: test
description: This rule flags file creation events where an .iso is written into user temporary locations, specifically the AppData local temp directory or the Outlook in-cache folder. Attackers may stage or deliver payloads by placing ISO images in temporary areas to support subsequent mounting or execution steps. Telemetry relies on Windows file event fields indicating the target filename/path and matching the .iso extension within the specified temp directories.
references:
  - https://twitter.com/Sam0x90/status/1552011547974696960
  - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_iso_file_mount.yml
author: "@sam0x90, Huntrule Team"
date: 2022-07-30
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_1:
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - .zip\
    TargetFilename|endswith: .iso
  selection_2:
    TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\
    TargetFilename|endswith: .iso
  condition: 1 of selection*
falsepositives:
  - Potential FP by sysadmin opening a zip file containing a legitimate ISO file
level: high
license: DRL-1.1
related:
  - id: 2f9356ae-bf43-41b8-b858-4496d83b2acb
    type: derived