Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)

Alerts when WinRAR/7-Zip/PeaZIP spawns ISO image tools, a pattern consistent with archive-delivered ISO payloads.

FreeUnreviewedSigmahighv1

windows-iso-image-opened-by-archiver-utilities-winrar-7-zip-peazip-fcdf69e5

title: "Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)"
id: 4ed76095-8cd8-4f7a-9019-0cca5d586908
status: test
description: This rule flags Windows process executions where an archiver-related parent process (WinRAR, 7-Zip, or PeaZIP) launches an ISO-related image tool (e.g., isoburn, PowerISO, ImgBurn). Such behavior can indicate an attempt to present a malicious ISO packaged in an archive, leveraging common archiving workflows to reach an image handling application. Telemetry relies on process creation events, matching parent executable paths and child executable names by suffix.
references:
  - https://twitter.com/1ZRR4H/status/1534259727059787783
  - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-07
tags:
  - attack.initial-access
  - attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \Winrar.exe
      - \7zFM.exe
      - \peazip.exe
    Image|endswith:
      - \isoburn.exe
      - \PowerISO.exe
      - \ImgBurn.exe
  condition: selection
falsepositives:
  - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction
level: high
license: DRL-1.1
related:
  - id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1
    type: derived

What it detects

This rule flags Windows process executions where an archiver-related parent process (WinRAR, 7-Zip, or PeaZIP) launches an ISO-related image tool (e.g., isoburn, PowerISO, ImgBurn). Such behavior can indicate an attempt to present a malicious ISO packaged in an archive, leveraging common archiving workflows to reach an image handling application. Telemetry relies on process creation events, matching parent executable paths and child executable names by suffix.

Known false positives

Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.