EXPLORE
Sign In
← Back to Explore
kqlHunting

ISO (Virtual DVD-ROM) file mount

Mounting of virtual Dvd ROM i.e. ISO files - useful for hunting Rougeplanet.

Detection Query

DeviceEvents
| where ActionType == @"UsbDriveMounted"
| where parse_json(AdditionalFields)["ProductName"] == 'Virtual DVD-ROM ' //Mounting of virtual Dvd ROM i.e. ISO files - useful for hunting Rougeplanet. 
//Block mounting of ISO files in device Control Policies.

Data Sources

DeviceEvents

Platforms

windows

Tags

defenderhunting
Raw Content
DeviceEvents
| where ActionType == @"UsbDriveMounted"
| where parse_json(AdditionalFields)["ProductName"] == 'Virtual DVD-ROM ' //Mounting of virtual Dvd ROM i.e. ISO files - useful for hunting Rougeplanet. 
//Block mounting of ISO files in device Control Policies.