Windows Alternate Data Stream Creation: Suspicious Zone.Identifier ADS Outside Browser Download

title: "Windows Alternate Data Stream Creation: Suspicious Zone.Identifier ADS Outside Browser Download"
id: fb04d0be-226c-4193-a884-681be805aaa4
status: test
description: This rule identifies creation of an Alternate Data Stream (ADS) marked with the [ZoneTransfer] header and ZoneId=3, specifically targeting a TargetFilename ending in :Zone.Identifier for file types commonly abused for execution. Attackers can use ADS to attach a Zone.Identifier stream to masquerade as downloaded content or influence how Windows and security checks treat files. The detection relies on Windows telemetry that records stream creation events, including stream contents, the target filename, and the originating process image for browser exclusions.
references:
  - https://www.bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml
author: frack113, Huntrule Team
date: 2022-10-22
modified: 2023-06-12
tags:
  - attack.stealth
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|startswith: "[ZoneTransfer]  ZoneId=3"
    TargetFilename|endswith: :Zone.Identifier
    TargetFilename|contains:
      - .exe
      - .scr
      - .bat
      - .cmd
      - .docx
      - .hta
      - .jse
      - .lnk
      - .pptx
      - .ps
      - .reg
      - .sct
      - .vb
      - .wsc
      - .wsf
      - .xlsx
  filter_optional_brave:
    Image|endswith: \brave.exe
  filter_optional_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_maxthon:
    Image|endswith: \maxthon.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_opera:
    Image|endswith: \opera.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_seamonkey:
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|endswith: \whale.exe
  filter_optional_snipping_tool:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.ScreenSketch_
    Image|endswith: \SnippingTool\SnippingTool.exe
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Packages\Microsoft.ScreenSketch_
      - "\\TempState\\Screenshot "
    TargetFilename|endswith: .png:Zone.Identifier
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Other legitimate browsers not currently included in the filter (please add them)
  - Legitimate downloads via scripting or command-line tools (Investigate to determine if it's legitimate)
level: medium
license: DRL-1.1
related:
  - id: 573df571-a223-43bc-846e-3f98da481eca
    type: derived