Hidden Executable In NTFS Alternate Data Stream

Status: test
Severity: medium
Log source: category create_stream_hash, product windows
Author: Florian Roth (Nextron Systems), @0xrawsec
Source: github.com/SigmaHQ/sigma

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Known false positives

This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.004` Hide Artifacts: NTFS File Attributes

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 15: FileCreateStreamHash

Rule body

title: Hidden Executable In NTFS Alternate Data Stream
id: b69888d4-380c-45ce-9cf9-d9ce46e67821
status: test
description: Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
references:
    - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
author: Florian Roth (Nextron Systems), @0xrawsec
date: 2018-06-03
modified: 2023-02-10
tags:
    - attack.stealth
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
    definition: 'Requirements: Sysmon or equivalent configured with Imphash logging'
detection:
    selection:
        Hash|contains: 'IMPHASH='
    filter_main_null:
        Hash|contains: 'IMPHASH=00000000000000000000000000000000'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Hash|contains: 'IMPHASH='

Stage 2: `not filter_main_null`

filter_main_null:
    Hash|contains: 'IMPHASH=00000000000000000000000000000000'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Hash`	match	`IMPHASH=00000000000000000000000000000000`	`excludes:Hash` `field:"Hash" value:"IMPHASH=00000000000000000000000000000000"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Hash`	match	`IMPHASH=`	`field:"Hashes" kind:match value:"IMPHASH="`