Hidden Executable In NTFS Alternate Data Stream — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems), @0xrawsec. Source status: test; severity: medium. Source dates: 2018-06-03 / 2023-02-10.

{
  "product": "windows",
  "category": "create_stream_hash",
  "definition": "Requirements: Sysmon or equivalent configured with Imphash logging"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 8a6b88b34bf01a8a3b138bd8b70c3fc92575424efbab00a7d8f8cb403ba28f8b

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Hidden Executable In NTFS Alternate Data Stream
id: b69888d4-380c-45ce-9cf9-d9ce46e67821
status: test
description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
references:
    - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
author: Florian Roth (Nextron Systems), @0xrawsec
date: 2018-06-03
modified: 2023-02-10
tags:
    - attack.stealth
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
    definition: 'Requirements: Sysmon or equivalent configured with Imphash logging'
detection:
    selection:
        Hash|contains: 'IMPHASH='
    filter_main_null:
        Hash|contains: 'IMPHASH=00000000000000000000000000000000'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar.
level: medium

Original YAML and metadata in JSON

False positives

• This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar.

Source references

• https://twitter.com/0xrawsec/status/1002478725605273600?s=21