1200KM / sigma-rule

Suspicious IO.FileStream — Sigma Rule

Sigma rule 70ad982f-67c8-40e0-a955-b920c2fa05cb. Suspicious IO.FileStream — Sigma Rule. Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.

Rule metadata and linked tags

Author: frack113. Source status: test; severity: medium. Source dates: 2022-01-09 / 2022-03-05.

Original logsource

{
  "product": "windows",
  "category": "ps_script",
  "definition": "Requirements: Script Block Logging must be enabled"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 1bd19b7fa0110e787749764cae8e08d1b88cbc84ac169ecd676b90c4471a5332

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

Original Sigma rule YAML, scroll horizontally if needed

title: Suspicious IO.FileStream
id: 70ad982f-67c8-40e0-a955-b920c2fa05cb
status: test
description: Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1006/T1006.md
author: frack113
date: 2022-01-09
modified: 2022-03-05
tags:
    - attack.stealth
    - attack.t1070.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - New-Object
            - IO.FileStream
            - '\\\\.\\'
    condition: selection
falsepositives:
    - Legitimate PowerShell scripts
level: medium

Original YAML and metadata in JSON

False positives

Legitimate PowerShell scripts

Source references

https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1006/T1006.md

Connected ecosystem references

Exact source-tagged techniques

T1070.003 · Clear Command History · Detection rules & anomalies

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.