You detect malicious ISO files by monitoring email attachments, downloads, and mounted disk images that are used to deliver payloads or bypass attachment filtering. Look for ISO files arriving from untrusted sources, followed by script or executable launch activity. Correlate file creation, mount, and process execution to confirm suspicious behaviour.
How malicious ISO files work on Windows
ISO files are useful to attackers because Windows can mount them as if they were legitimate disks, which helps a phishing lure blend into normal user behaviour. The malicious payload is often hidden inside the image and only becomes active after the user opens the mounted content, runs a shortcut, script, or executable, or follows a deceptive file chain.
Detection starts with the delivery path and the execution path, not just the file extension. Treat ISO files as suspicious when they arrive through email, link-based sharing, browser downloads, or archive extraction from untrusted sources, especially when the next step is a script or binary launch from the mounted volume.
Windows telemetry is useful because a mounted ISO creates a short chain of observable events: file arrival, disk-image mount, new volume visibility, file access from the mounted drive, and then child process execution. Correlating those events makes it much easier to distinguish a benign installer image from a phishing payload that is staging code for execution.
What to look for in telemetry and endpoint activity
Search for ISO files that are opened shortly after receipt and are followed by uncommon child processes such as script hosts, command interpreters, launcher binaries, or Office applications spawning from the mounted path. A strong signal is a user double-clicking content inside the image and then generating an execution pattern that would be unusual for a normal software distribution disk.
Also inspect the surrounding file activity. Attackers often rely on misleading filenames, double extensions, or a chain where the ISO contains a shortcut, script, or compressed payload that obscures the final executable. If the mounted image is read from user-writable locations and then launches code from the same location, that is a useful hunting lead.
Endpoint detection should also account for the fact that ISO mounting can bypass some attachment filters and email gateway scrutiny. That makes file origin, parent-child process lineage, and mount events more important than static extension-based blocking alone. The most reliable detections combine email, download, filesystem, and process telemetry rather than depending on any single control.
Detection strategy for phishing-delivered disk images
A practical hunting rule is to join three signals: an ISO from an untrusted source, a mount event, and a subsequent process start from the mounted drive. If those events occur within a short window and the launched binary is a script host or another LOLBIN-style interpreter, the probability of malicious use rises sharply.
For a broader phishing view, use the Phishing Guide to map ISO delivery into the wider set of lure types, attachment abuse patterns, and detection layers that attackers use to get initial execution. That helps separate ISO-based delivery from lookalike-domain or link-based phishing while keeping the same core triage logic.
When you need a control-oriented view of phishing delivery, Top 10 Phishing Techniques is useful for placing ISO attachments alongside other delivery methods, especially when the lure is designed to get the user to open a file and execute code locally.
On Windows estates, the easiest misses usually come from incomplete logging. If you cannot see mount events, file origin, and child process creation together, you will struggle to prove whether an ISO was just opened or actually used as the delivery mechanism for malware.
Risk and Threat Considerations
Malicious ISO files are attractive because they can look like routine software media while still delivering payloads through a trusted Windows workflow. That combination raises the odds of user interaction, weakens attachment-based scrutiny, and can create a clean execution path before defenders recognise the lure.
Failure mechanism: The attacker packages a payload or launcher inside a disk image, delivers it through phishing or download abuse, and waits for the user to mount the image and execute content from it. This works best when telemetry does not correlate the mount event with the first suspicious process launch.
Impact: Successful use can lead to malware execution, credential theft, follow-on payload staging, and lateral movement from the initial workstation. If the ISO is treated as a normal installer image, analysts may also lose the opportunity to catch the intrusion at the first execution step.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1204 — User Execution | ISO phishing depends on user-opening and running payloads from the mounted image. |
| Recommendation — Correlate user execution after ISO mount and alert on suspicious child processes. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection needs mount, file, and process telemetry to reconstruct the attack chain. |
| CIS-10 — Malware Defenses | Malicious ISO delivery is a malware delivery problem that benefits from scanning and containment. | |
| Recommendation — Centralize and review endpoint logs that show ISO mounts and follow-on execution. Scan downloaded disk images and isolate endpoints that launch suspicious content from them. | ||
Practitioner Guidance
What to verify: Confirm whether your EDR or SIEM can tie together attachment or download origin, ISO mount activity, and the first executable or script launched from the mounted volume. If those events are siloed, build a correlation view before tuning specific detections.
Decision rule: If the ISO came from email, a browser download, or an external share and the mounted image immediately precedes script or executable execution, treat it as hostile until proven otherwise. Benign software images usually show a more predictable installer pattern and a clearer trust path.
What good looks like: Analysts can quickly answer three questions from telemetry: where the ISO came from, when it was mounted, and what executed from it. That evidence is usually enough to decide whether to isolate the endpoint, preserve the image for analysis, and widen the hunt for related delivery artifacts.
Practitioner takeaway: The real detection value is in sequence, not extension. If you can correlate untrusted ISO delivery with mount activity and the first post-mount execution, you can spot phishing payloads that would otherwise look like ordinary disk-image use.
Related resources from NHI Mgmt Group
- How should security teams detect malicious Windows shortcut files when email filtering and signature-based scanning are already in place?
- How do you detect attackers searching for credentials in files and the registry on Windows?
- How do you detect Kerberos relay attacks such as KrbRelayUp on Windows?
- How do you detect NTLM brute force attacks on Windows domains?