Windows Recent Items shows ISO/IMG/VHD image mount shortcut (.lnk) usage

title: Windows Recent Items shows ISO/IMG/VHD image mount shortcut (.lnk) usage
id: 94401ccb-501c-435d-8788-eab4e642214f
status: test
description: This rule matches creation of recent file entries that include shortcuts ending with .iso.lnk, .img.lnk, .vhd.lnk, or .vhdx.lnk under the Microsoft\Windows\Recent path. Attackers and phishing payloads may use these mounted image shortcuts to lure users into opening malicious content or to establish persistence via Windows Recent artifacts. It relies on Windows file event telemetry capturing the target filename and its location within the Recent directory.
references:
  - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
  - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
  - https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/
  - https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_iso_file_recent.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-11
tags:
  - attack.initial-access
  - attack.t1566.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - .iso.lnk
      - .img.lnk
      - .vhd.lnk
      - .vhdx.lnk
    TargetFilename|contains: \Microsoft\Windows\Recent\
  condition: selection
falsepositives:
  - Cases in which a user mounts an image file for legitimate reasons
level: medium
license: DRL-1.1
related:
  - id: 4358e5a5-7542-4dcb-b9f3-87667371839b
    type: derived