Windows ISO File Creation in User Temp and Outlook Cache Folders

Alerts on creation of .iso files in Windows AppData temp or Outlook cache paths.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: @sam0x90 (SigmaHQ), DRL 1.1
Published: 2022-07-30
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566.001Spearphishing Attachment
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies file creation events where an ISO file is written to common temporary storage locations, including the AppData Local Temp folder or Outlook-related INetCache content. Attackers may stage ISO images in these directories to support subsequent execution steps while reducing visibility in typical application paths. It relies on Windows file event telemetry that includes the created file path in TargetFilename and supports matching on folder substrings and a .iso suffix.

Reporting behind it

Related detections9 linkedT1566.001 — drag to rearrange

Suspicious mstsc Launch of RDP File From User Download or Temp Path (via process_creation)

Suspicious Regsvr32 Squiblydoo Remote Scriptlet Execution via Command Line (via process_creation)

Possible Mamba 2FA AiTM Phishing URL Pattern

Suspicious DLL Written to Explorer IconCache Path

Suspicious DNS Query to HTML Smuggling AiTM Phishing Domain

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Malicious Equation Editor Child Process Execution via process_creation

Microsoft 365 inbound suspicious email delivered to Inbox or Junk

Web Browser Opens .HTM/.HTML from Downloads Folder on Windows

Windows ISO File Creation in User Temp and Outlook Cache Folders

Pivot detection · T1566.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-iso-file-creation-in-user-temporary-folders-2f9356ae

title: Windows ISO File Creation in User Temp and Outlook Cache Folders
id: 7920e8a9-da9d-42c2-ba2f-bb5f637407c3
status: test
description: This rule identifies file creation events where an ISO file is written to common temporary storage locations, including the AppData Local Temp folder or Outlook-related INetCache content. Attackers may stage ISO images in these directories to support subsequent execution steps while reducing visibility in typical application paths. It relies on Windows file event telemetry that includes the created file path in TargetFilename and supports matching on folder substrings and a .iso suffix.
references:
  - https://twitter.com/Sam0x90/status/1552011547974696960
  - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_iso_file_mount.yml
author: "@sam0x90, Huntrule Team"
date: 2022-07-30
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_1:
    TargetFilename|contains|all:
      - \AppData\Local\Temp\
      - .zip\
    TargetFilename|endswith: .iso
  selection_2:
    TargetFilename|contains: \AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\
    TargetFilename|endswith: .iso
  condition: 1 of selection*
falsepositives:
  - Potential FP by sysadmin opening a zip file containing a legitimate ISO file
level: high
license: DRL-1.1
related:
  - id: 2f9356ae-bf43-41b8-b858-4496d83b2acb
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL