All Posts - Malicious Link - Blog by mubix - Rob Fuller · May 27, 2022
Blocking ISO mounting
0Sign in to vote or save
This site does not allow itself to be embedded. You can still read it on the original site — the toolbar below keeps your place in the directory.
Update: 10/15/2022 One of the hard parts of implementing a block like this is the concern that it will “break something”. The DFIR Report’s post on Bumblebee Round 2 has a great suggestion on how to detect legitimate (and illegitimate) use of ISO mounting using Event ID 12 of the Microsoft-Windows-VHDMP-Operational logs. It’s not one of the main Application/System/Security…
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.