{"id":"b69888d4-380c-45ce-9cf9-d9ce46e67821","title":"Hidden Executable In NTFS Alternate Data Stream","description":"Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash","author":"Florian Roth (Nextron Systems), @0xrawsec","status":"test","level":"medium","date":"2018-06-03","modified":"2023-02-10","tags":["attack.stealth","attack.s0139","attack.t1564.004"],"technique_ids":["T1564.004"],"logsource":{"product":"windows","category":"create_stream_hash","definition":"Requirements: Sysmon or equivalent configured with Imphash logging"},"falsepositives":["This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar."],"references":["https://twitter.com/0xrawsec/status/1002478725605273600?s=21"],"source_path":"rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml","source_sha256":"8a6b88b34bf01a8a3b138bd8b70c3fc92575424efbab00a7d8f8cb403ba28f8b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Hidden Executable In NTFS Alternate Data Stream\nid: b69888d4-380c-45ce-9cf9-d9ce46e67821\nstatus: test\ndescription: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash\nreferences:\n    - https://twitter.com/0xrawsec/status/1002478725605273600?s=21\nauthor: Florian Roth (Nextron Systems), @0xrawsec\ndate: 2018-06-03\nmodified: 2023-02-10\ntags:\n    - attack.stealth\n    - attack.s0139\n    - attack.t1564.004\nlogsource:\n    product: windows\n    category: create_stream_hash\n    definition: 'Requirements: Sysmon or equivalent configured with Imphash logging'\ndetection:\n    selection:\n        Hash|contains: 'IMPHASH='\n    filter_main_null:\n        Hash|contains: 'IMPHASH=00000000000000000000000000000000'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"}],"data_path":"data/detection-rules/b69888d4-380c-45ce-9cf9-d9ce46e67821.json","kind":"sigma"}