ISO or Image Mount Indicator in Recent Files (4358e5a5-7542-4dcb-b9f3-87667371839b)
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks. This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.