Detectionhightest

Phishing Pattern ISO in Archive

Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Tue Jun 07fcdf69e5-a3d3-452a-9724-26f2308bf2b1windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith:
            - '\Winrar.exe'
            - '\7zFM.exe'
            - '\peazip.exe'
        Image|endswith:
            - '\isoburn.exe'
            - '\PowerISO.exe'
            - '\ImgBurn.exe'
    condition: selection