ISO and Container File Malware Delivery Guide: Disk Images, Archives and Mark-of-the-Web

Attackers wrap malware inside disk images and archives because the container can strip away the warning signs Windows relies on to stop a user running something downloaded from the internet. In plain terms, a file that arrives from the internet normally carries a hidden label, the Mark-of-the-Web, that tells Office, SmartScreen and other controls to treat it with suspicion. Put that file inside an ISO, IMG, VHD or archive, and for years the label was often lost when the user opened the container. This guide explains how container delivery works, what Microsoft and archive tool makers changed, and how to layer email, endpoint and application controls so that a double-click on a disk image does not become a foothold. It is written for endpoint, email security and SOC teams, and it is strictly defensive: no samples, commands or attacker walkthroughs.

Key takeaways

• The container is the evasion, not the payload. ISO, IMG, VHD, VHDX and archive files are used to carry a shortcut, script or DLL past email filters and Mark-of-the-Web checks, so defences must look inside and around the container.
• Mark-of-the-Web is a label, not a lock. It is an NTFS alternate data stream named Zone.Identifier, and it only helps when every tool in the chain preserves it and every control downstream reads it.
• Patching closed the biggest gap, not every gap. CVE-2022-41091 (November 2022) fixed a Windows Mark-of-the-Web bypass and is listed in the CISA KEV catalogue as used in ransomware campaigns, but further bypasses in SmartScreen, Windows and archivers have followed.
• Most organisations do not need users to receive disk images by email. Blocking ISO, IMG, VHD and VHDX at the gateway and disabling double-click mounting removes the route with little business cost.
• Execution controls are the backstop. Attack surface reduction rules, App Control for Business or AppLocker, and SmartScreen catch what slips through, provided they run in enforce mode after a measured audit period.

How container file delivery works

Container delivery became a mainstream initial access route in 2022, as Microsoft's default blocking of internet macros in Office pushed criminal groups to find another way to get a user to run code. The pattern is consistent across families: an email, a link or an HTML attachment delivers a container, the user opens it, Windows presents its contents as a new drive or folder, and the user double-clicks a file that looks like a document. See the Macro Malware Guide for the shift away from macros.

• Disk images (ISO, IMG): Windows 8 and later can mount these natively with a double-click, presenting them as a read-only optical drive. Users rarely recognise this as risky because the experience looks like opening a folder.
• Virtual hard disks (VHD, VHDX): also mounted natively by Windows. They can be larger and are less often on gateway block lists than ISO, which is why defenders should block them explicitly.
• Archives (ZIP, RAR, 7z, CAB, ARJ, GZIP and others): extracted by Windows or a third-party archiver. Whether extracted files keep the Mark-of-the-Web depends on the tool and its version.
• Nesting: an ISO inside a password-protected ZIP, or an ISO assembled in the browser by an HTML attachment, hides the container from gateway scanning. See the HTML Smuggling Guide.
• What sits inside: typically a shortcut (LNK) that launches a hidden DLL or script, a disguised executable, or a legitimate signed program placed next to a malicious DLL it will load. See the Malicious LNK Files Guide.

MITRE ATT&CK records this behaviour under T1553.005 Mark-of-the-Web Bypass, with procedure examples for QakBot (S0650) packaged in ISO files, APT38 using ISO and VHD files, APT29 embedding ISO and VHDX files in HTML, and EXOTIC LILY (G1011) using LNK files inside ISO attachments. Bumblebee (S1039) and IcedID (S0483) are recorded as relying on users opening ISO files that contain shortcuts and DLLs. The second stage is usually a loader. See the Malware Loaders and Droppers Guide.

Mark-of-the-Web explained

When a browser, email client or other aware application saves a file from the internet onto an NTFS volume, Windows attaches an alternate data stream called Zone.Identifier recording the security zone it came from. Microsoft documents the ZoneId values as 0 My Computer, 1 Local intranet, 2 Trusted sites, 3 Internet and 4 Restricted sites, and by default the mark is applied only to files from the Internet and Restricted sites zones.

Three limits matter in practice. The mark only exists on NTFS, so files saved to FAT32 media lose it. Files opened from OneDrive or SharePoint with "Open in Desktop App", or synced by the OneDrive client, do not receive it according to Microsoft. And any program that extracts or copies a file without copying the stream silently drops it. That last point is the root of container abuse: ATT&CK notes that container files downloaded from the internet are marked, but the files within may not inherit the mark after extraction or mounting, and are then treated as local files.

What Microsoft and archive tool makers changed

The fix history is a useful patch and configuration checklist, because several bypasses were exploited before they were fixed. The CVE identifiers below are all in the CISA Known Exploited Vulnerabilities catalogue.

• 7-Zip: the project's history file records that version 22.00 (15 June 2022) added a "Propagate Zone.Id stream" option and a matching command-line switch, and version 24.09 (29 November 2024) fixed a bug where the 7-Zip File Manager did not propagate the stream. Propagation is an option, so configure it centrally rather than assuming the default.
• Other archivers: behaviour differs by product and version. Test each archiver you permit by extracting a marked test file and checking whether the extracted file carries Zone.Identifier, and remove archivers you cannot test or manage.
• Office: the default blocking of internet macros (Current Channel Version 2206 from 27 July 2022, after a Version 2203 preview from April 2022) only helps if the mark survives the container, which is another reason the Windows fix and archiver settings matter.

Defences by layer

No single control is enough, because a container can arrive by email, web download, chat or file share, and the payload inside varies. Layer the controls so that each one assumes the previous one failed.

Email and web gateways

• Block container types outright: NCSC guidance is to allow only the file types users would reasonably expect to receive. In Microsoft Defender for Office 365, the common attachments filter default list already includes iso, img, cab, lnk, hta, vbs and wsf; vhd is in the additional list and must be added, and vhdx is in neither list, so cover it with a mail flow rule on the extension.
• Do not rely on true type detection for images: Microsoft states that true type matching in the common attachments filter does not cover iso, img or vhd and falls back to extension matching, so a renamed image may pass. Add content-based detection at the gateway where your product supports it.
• Handle what cannot be scanned: Safe Attachments can quarantine password-protected attachments that cannot be scanned. Decide whether encrypted archives are needed at all from external senders.
• Detonate: Safe Attachments in Block mode opens attachments in a virtual environment before delivery, and zero-hour auto purge removes messages later found to be malicious. Use the equivalent features of any other gateway.
• Web proxies: apply the same file-type policy to downloads, including from file-sharing sites. See the Email Security Guide.

Endpoint configuration

• Disable double-click mounting: ATT&CK mitigation M1042 suggests changing the Windows Explorer file associations for .iso, .img, .vhd and .vhdx so the automatic Mount action is not offered, and notes this does not remove the mount capability itself. Deploy through Group Policy Preferences or Intune, and keep a documented exception group for IT staff who mount images. See the Microsoft Intune Guide.
• Unregister or reassociate risky extensions: ATT&CK M1038 also suggests unregistering container extensions in File Explorer. Associating script types such as .js, .vbs and .hta with Notepad has the same intent for the payload inside.
• Keep zone information: make sure the Attachment Manager policy "Do not preserve zone information in file attachments" is not enabled, since enabling it stops the mark being written.
• Patch: treat MOTW and SmartScreen bypasses in the KEV catalogue as priority patches, not routine ones.

Execution controls

See the Application Allowlisting Guide and the Microsoft Defender for Endpoint Guide for deployment detail.

Choosing your approach

• Gateway block versus quarantine: rejecting with a non-delivery report is simplest and tells legitimate senders to use another route; quarantine suits organisations that must occasionally receive images (for example software vendors or engineering firms) and have analysts to review releases.
• Disable mounting versus allowlisting: disabling double-click mounting is cheap and quick but only removes one path, since users can still extract or mount through other means. Application control closes the class of problem but needs an inventory, a managed installer strategy and ongoing ownership.
• Small organisations: start with gateway blocking of iso, img, vhd and vhdx, current Windows updates, the email and obfuscated script ASR rules, and removing third-party archivers in favour of the built-in one. This covers most real campaigns with a few hours of work.
• Large organisations: add the prevalence ASR rule, App Control in audit then enforce for standard user rings, archiver configuration through software management, and detection content for mount events and execution from virtual drives.
• Developers and IT staff: they legitimately use ISO and VHDX files. Give them a separate policy ring with mounting allowed, stronger monitoring, and a requirement to obtain images from internal repositories rather than email.

Rolling out the controls

1. Measure the need: report on 90 days of inbound mail and web downloads by file type. Most organisations find few or no legitimate external ISO, IMG or VHD deliveries.
2. Block at the gateway: add the container extensions to the attachment filter, with an exception process owned by the email team. This is low risk and reversible by removing the extension.
3. Patch and verify the mark: confirm all Windows endpoints are on a cumulative update after November 2022, then test with a harmless marked image: files inside the mounted image should carry the mark.
4. Standardise archivers: remove or upgrade unmanaged archivers and set zone propagation centrally for those you keep.
5. Audit ASR rules: enable the four rules above in audit mode for two to four weeks, review audited events with application owners, and add narrow exclusions only for named, signed tools.
6. Enforce in rings: move to block for a pilot ring, then broad deployment. Roll back a single rule by setting it to audit, not by disabling the whole ASR policy.
7. Disable double-click mounting: deploy the file association change to standard users, with the IT exception group, and monitor help desk tickets for a fortnight.
8. Add application control: run App Control or AppLocker in audit for standard users, then enforce. Keep the previous policy version so rollback is a single redeployment.

Detection and measurement

Metrics that show the programme is working:

• Gateway coverage: percentage of inbound mail and web traffic subject to the container file-type policy (target 100 per cent).
• Patch level: percentage of Windows endpoints on a cumulative update that includes all MOTW and SmartScreen KEV fixes.
• ASR enforcement: percentage of devices with the four relevant rules in block mode, and number of active exclusions.
• Mount rate: image mounts per 1,000 standard users per month, which should fall towards zero after mounting is disabled.
• Archiver estate: count of unmanaged or outdated archiver installations.
• Time to contain: median time from execution from a mounted drive to host isolation and credential reset.

Where identity fits

The loaders delivered through containers commonly lead to credential theft and hands-on-keyboard access. Treat any confirmed execution from a mounted image as a potential credential incident: reset the user's password and revoke sessions and tokens, and check whether the user had local administrator rights, which would let the second stage tamper with defences. Removing standing local admin rights also limits what a payload can change. See the Malware Guide for handling infostealer detections as identity events.

Framework mapping

Common failure patterns

• Blocking ISO but not VHD or VHDX: attackers moved to less familiar image types, and in Microsoft's filter vhdx is not on either built-in list.
• Trusting the extension: renamed images and images nested inside encrypted archives pass extension-only filters. Decide policy for password-protected archives from external senders.
• Assuming patching ended the problem: multiple later MOTW and SmartScreen bypasses reached the KEV catalogue, and third-party archivers had their own. Keep testing that the mark survives.
• Leaving ASR rules in audit indefinitely: audit mode produces data, not protection. Set a dated decision point for each rule.
• Unmanaged archivers: users install their own extraction tools, often old versions that drop the mark. Inventory and standardise.
• Cleaning the host but not the account: reimaging a device after an ISO-delivered loader while leaving the user's sessions and tokens valid lets the attacker return. Reset credentials as part of containment.

Practitioner checklist

• Block iso, img, vhd and vhdx at email and web gateways, with a documented exception process.
• Decide and enforce a policy for password-protected archives from external senders.
• Confirm every Windows endpoint has the November 2022 and later MOTW and SmartScreen fixes, and test mark propagation into mounted images.
• Standardise on managed archivers with zone propagation enabled; remove the rest.
• Disable double-click mounting for standard users through file association policy.
• Move the email executable content, prevalence, JavaScript/VBScript and obfuscated script ASR rules from audit to block.
• Deploy App Control for Business or AppLocker for standard user devices, audit first.
• Alert on execution from newly mounted drives and on script or proxy binaries launched soon after a mount.
• Include credential reset and session revocation in the containment playbook for container-delivered malware.
• Review metrics monthly and retest controls after major Windows or Office updates.

Standards and references

• MITRE ATT&CK: Mark-of-the-Web Bypass (T1553.005)
• CISA: Known Exploited Vulnerabilities Catalog
• Microsoft Learn: Macros from the internet are blocked by default in Office
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Anti-malware protection in EOP
• Microsoft Learn: App Control for Business
• NCSC: Mitigating malware and ransomware attacks
• 7-Zip: Version history

Related NHI Mgmt Group resources: Malware Guide · OneNote Malware Delivery Guide · HTML Smuggling Guide · Malicious LNK Files Guide · Malware Loaders and Droppers Guide