Phishing Pattern ISO in Archive
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND PARENTPROCESSNAME endswith "\Winrar.exe,\7zFM.exe,\peazip.exe" AND PROCESSNAME endswith "\isoburn.exe,\PowerISO.exe,\ImgBurn.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems)
