Windows Security Event 4663: ISO CD-ROM device mount activity
Alerts on Windows file-access events consistent with ISO mounting by activity under \\Device\\CdRom.
- Product
- windows
- Service
- security
- Author
- Syed Hasan (@syedhasan009) (SigmaHQ), DRL 1.1
- Published
- 2021-05-29
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when an endpoint mounts an ISO image by matching Windows Security auditing events where a file access occurs under the CD-ROM device path (\Device\CdRom). It matters because attackers commonly use mounted ISO media to stage payloads or deliver initial access tools via removable-style drives. The detection relies on Windows Security log EventID 4663 with ObjectServer=Security, ObjectType=File, and ObjectName starting with \Device\CdRom, while excluding specific known ISO installer artifacts (autorun.ico, setup.exe, setup64.exe).
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
- proofpoint.comhttps://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
- twitter.comhttps://twitter.com/MsftSecIntel/status/1257324139515269121
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_iso_mount.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Security Event 4663: ISO CD-ROM device mount activity"
id: 205157b8-cc15-46aa-bbac-cdddf1578dc3
status: test
description: This rule identifies when an endpoint mounts an ISO image by matching Windows Security auditing events where a file access occurs under the CD-ROM device path (\Device\CdRom). It matters because attackers commonly use mounted ISO media to stage payloads or deliver initial access tools via removable-style drives. The detection relies on Windows Security log EventID 4663 with ObjectServer=Security, ObjectType=File, and ObjectName starting with \Device\CdRom, while excluding specific known ISO installer artifacts (autorun.ico, setup.exe, setup64.exe).
references:
- https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
- https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
- https://twitter.com/MsftSecIntel/status/1257324139515269121
- https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_iso_mount.yml
author: Syed Hasan (@syedhasan009), Huntrule Team
date: 2021-05-29
modified: 2023-11-09
tags:
- attack.initial-access
- attack.t1566.001
logsource:
product: windows
service: security
definition: The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure
detection:
selection:
EventID: 4663
ObjectServer: Security
ObjectType: File
ObjectName|startswith: \Device\CdRom
filter_main_generic:
ObjectName:
- \Device\CdRom0\autorun.ico
- \Device\CdRom0\setup.exe
- \Device\CdRom0\setup64.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Software installation ISO files
level: medium
license: DRL-1.1
related:
- id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073
type: derived