PAY-ISO-LNKExecution

ISO / IMG Mounting → LNK Execution

ISO / IMG containers bypass Mark-of-the-Web — opens as a virtual disk, LNK inside auto-executes a hidden binary.

§ Where this technique fits

PAY-ISO-LNK is catalogued under the Execution tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

ISO container → LNK → stage from CDN → C2
Email attaches an ISO. Windows mounts it as a drive, bypassing Mark-of-the-Web. LNK inside runs a hidden binary that pulls the real stager from a CDN — Defender often misses the chain.
step 2 / 6

§ What commonly comes next

01
HTA / VBS / WSF Execution
PAY-HTA-VBS · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

ISO container → LNK → stage from CDN → C2

§ What commonly comes next