Execute From Alternate Data Streams

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.004` Hide Artifacts: NTFS File Attributes

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Execute From Alternate Data Streams
id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c
status: test
description: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
author: frack113
date: 2021-09-01
modified: 2022-10-09
tags:
    - attack.stealth
    - attack.t1564.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_stream:
        CommandLine|contains: 'txt:'
    selection_tools_type:
        CommandLine|contains|all:
            - 'type '
            - ' > '
    selection_tools_makecab:
        CommandLine|contains|all:
            - 'makecab '
            - '.cab'
    selection_tools_reg:
        CommandLine|contains|all:
            - 'reg '
            - ' export '
    selection_tools_regedit:
        CommandLine|contains|all:
            - 'regedit '
            - ' /E '
    selection_tools_esentutl:
        CommandLine|contains|all:
            - 'esentutl '
            - ' /y '
            - ' /d '
            - ' /o '
    condition: selection_stream and (1 of selection_tools_*)
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection_stream and (1 of selection_tools_*)

Stage 1: `selection_stream`

selection_stream:
    CommandLine|contains: 'txt:'

Stage 2: `selection_tools_type`

selection_tools_type:
    CommandLine|contains|all:
        - 'type '
        - ' > '

Stage 3: `selection_tools_makecab`

selection_tools_makecab:
    CommandLine|contains|all:
        - 'makecab '
        - '.cab'

Stage 4: `selection_tools_reg`

selection_tools_reg:
    CommandLine|contains|all:
        - 'reg '
        - ' export '

Stage 5: `selection_tools_regedit`

selection_tools_regedit:
    CommandLine|contains|all:
        - 'regedit '
        - ' /E '

Stage 6: `selection_tools_esentutl`

selection_tools_esentutl:
    CommandLine|contains|all:
        - 'esentutl '
        - ' /y '
        - ' /d '
        - ' /o '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/E` corpus 3 (sigma 3) `/d` corpus 3 (sigma 2, splunk 1) `/o` corpus 2 (sigma 2) `/y` corpus 2 (sigma 2) `>` corpus 5 (sigma 5) `export` corpus 3 (sigma 3) `.cab` corpus 5 (sigma 5) `esentutl` `makecab` `reg` corpus 5 (sigma 5) `regedit` `txt:` `type` corpus 6 (sigma 6)	`field:"CommandLine" kind:match`

Execute From Alternate Data Streams

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_stream

Stage 2: selection_tools_type

Stage 3: selection_tools_makecab

Stage 4: selection_tools_reg

Stage 5: selection_tools_regedit

Stage 6: selection_tools_esentutl