Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1566Phishing
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process executions where an archiver-related parent process (WinRAR, 7-Zip, or PeaZIP) launches an ISO-related image tool (e.g., isoburn, PowerISO, ImgBurn). Such behavior can indicate an attempt to present a malicious ISO packaged in an archive, leveraging common archiving workflows to reach an image handling application. Telemetry relies on process creation events, matching parent executable paths and child executable names by suffix.

Reporting behind it

Related detections9 linkedT1566 — drag to rearrange

Malicious Office 365 Email Rule Breach - On Behalf (via office365)

Suspicious AWS Console AiTM Phishing Kit API Endpoints

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

AWS CloudTrail SSM SendCommand Successful Execution for Instance

Proxy WebDAV MiniRedir Drives Execution from External Shares

Windows WebDAV Temporary File Creation with Suspicious Extensions

Okta FastPass blocks phishing authentication attempts via MFA

macOS Script Editor Spawns Suspicious Command-Line Interpreters

Suspicious Process Execution by Microsoft OneNote on Windows Child Programs

Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)

Pivot detection · T1566 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-iso-image-opened-by-archiver-utilities-winrar-7-zip-peazip-fcdf69e5

title: "Windows: ISO Image Opened by Archiver Utilities (WinRAR/7-Zip/PeaZIP)"
id: 4ed76095-8cd8-4f7a-9019-0cca5d586908
status: test
description: This rule flags Windows process executions where an archiver-related parent process (WinRAR, 7-Zip, or PeaZIP) launches an ISO-related image tool (e.g., isoburn, PowerISO, ImgBurn). Such behavior can indicate an attempt to present a malicious ISO packaged in an archive, leveraging common archiving workflows to reach an image handling application. Telemetry relies on process creation events, matching parent executable paths and child executable names by suffix.
references:
  - https://twitter.com/1ZRR4H/status/1534259727059787783
  - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-07
tags:
  - attack.initial-access
  - attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - \Winrar.exe
      - \7zFM.exe
      - \peazip.exe
    Image|endswith:
      - \isoburn.exe
      - \PowerISO.exe
      - \ImgBurn.exe
  condition: selection
falsepositives:
  - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction
level: high
license: DRL-1.1
related:
  - id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL