topic Re: Global Rule a4978720-39fc-404f-bb74-c3db07ef4f9d - ISO mounted manually questions in Cortex XDR Discussions

Global Rule a4978720-39fc-404f-bb74-c3db07ef4f9d - ISO mounted manually questions

RFeyertag — Mon, 01 Aug 2022 12:17:00 GMT

Hello dear community,

in my mount tests I could find out following:

- if you mount the same file name 2 times with different file data inside the iso, the alert isn't created because the file isn't beeing created. I think the recent folder is not made for this, because the lnk file stays there.

- when mounting via cmd.exe no lnk file is created in recent folder

is there a better way to create a check for mounting iso/img files?

Rob

Re: Global Rule a4978720-39fc-404f-bb74-c3db07ef4f9d - ISO mounted manually questions

SilviuMihailDascalu — Mon, 08 Aug 2022 13:18:40 GMT

Hi @RFeyertag ,

First of all I want to ask in what version of Windows have you tested that? Secondly please open immediately a TAC case regarding this issue in order to be investigated properly.

In the mean time I'm researching some ways to identify manually mounted ISOs.

Thanks,

Silviu

Re: Global Rule a4978720-39fc-404f-bb74-c3db07ef4f9d - ISO mounted manually questions

RFeyertag — Mon, 08 Aug 2022 14:11:21 GMT

Hello Silviu,

I tested on Windows 10 Pro 21H2.

I will open a TAC Ticket as soon as I can.

Rob

Re: Global Rule a4978720-39fc-404f-bb74-c3db07ef4f9d - ISO mounted manually questions

SilviuMihailDascalu — Mon, 08 Aug 2022 14:31:21 GMT

Thanks @RFeyertag !

Also wanted to let you know that I've tested this with 2 different Ubuntu ISO's, in two different locations and same file name as you did and I can see the alerts were generated successfully so it's better to take this forward with TAC.

Let me know if you have any questions or concerns!