Detecting ISO and IMG Container Delivery

Attackers ship payloads inside ISO and IMG files because the container has historically broken mark-of-the-web propagation, so files inside could run without the usual download warning. Microsoft has tightened this across updates, but behaviour varies by build and by how the image was obtained, so assume the gap exists until you have tested your own fleet.

Signals at a Glance

Mount, Then Execute

The reliable chain is: image lands, image mounts, something runs from the new volume. Correlate on the device and a short window. Execution from a drive letter that is neither the system drive nor a known removable or network mapping is the pivot:

// Defender XDR (KQL) - image dropped, then processes run from a non-system volume
let images = DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".iso" or FileName endswith ".img"
| project ImgTime=Timestamp, DeviceId, DeviceName, ImgName=FileName, ImgPath=FolderPath, SHA256,
          Origin=FileOriginUrl, Sender=InitiatingProcessFileName;
images
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FolderPath !startswith "C:" and FolderPath matches regex @"^[D-Z]:"
    | where InitiatingProcessFileName in~ ("explorer.exe","cmd.exe","powershell.exe")
    | project ExecTime=Timestamp, DeviceId, FileName, FolderPath, ProcessCommandLine
) on DeviceId
| where ExecTime between (ImgTime .. ImgTime + 1h)
| project ImgTime, ExecTime, DeviceName, ImgName, Sender, Origin, FileName, FolderPath, ProcessCommandLine
// tune/validate: exclude drives your organisation maps (home, software distribution, USB policy)

Mark-of-the-Web and Prevention

Do not rely on the warning prompt alone. Detect the container, then check whether the contents carry a zone marker, and reduce the attack surface where the business allows:

title: Disk Image Created in User Download Locations
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - '\Downloads\'
      - '\Content.Outlook\'
      - '\AppData\Local\Temp\'
    TargetFilename|endswith:
      - '.iso'
      - '.img'
      - '.vhd'
      - '.vhdx'
  condition: selection
level: low
# Informational on its own: use as a join source for execution and mount events.
# tune/validate: software engineers and lab users handle images routinely.

• Test mark-of-the-web propagation on your builds by mounting an image that carries the marker and checking the zone stream on its contents.
• Where users have no need for images, disable automatic mounting or block the extensions at the gateway and the web proxy.
• Ask what else was in the container: a lone LNK plus a DLL in an otherwise empty image is a strong sign of malicious packaging.