Suspicious Hidden Executable In NTFS Alternate Data Stream (via create_stream_hash)

title: Suspicious Hidden Executable In NTFS Alternate Data Stream (via create_stream_hash)
id: 22cd4562-6ada-5adf-bd58-871de7060301
status: stable
description: This rule detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
references:
    - https://attack.mitre.org/techniques/T1564/004/
    - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
author: Huntrule Team
date: 2026-01-18
tags:
    - attack.stealth
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
    definition: 'Requirements: Sysmon or equivalent configured with Imphash logging'
detection:
    selection:
        Hash|contains: 'IMPHASH='
    filter_main_null:
        Hash|contains: 'IMPHASH=00000000000000000000000000000000'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium