huntrule

Windows Alternate Data Stream Creation: Suspicious Zone.Identifier ADS Outside Browser Download

Flags suspicious creation of :Zone.Identifier ADS streams (ZoneTransfer/ZoneId=3) on file types outside typical browsers.

FreeReviewedSigma · Medium · v2
Product
windows
Category
create_stream_hash
Author
frack113 (SigmaHQ), DRL 1.1
Published
2022-10-22
Updated
2026-07-31
AnalysisDetection
title: "Windows Alternate Data Stream Creation: Suspicious Zone.Identifier ADS Outside Browser Download"
id: fb04d0be-226c-4193-a884-681be805aaa4
status: test
description: This rule identifies creation of an Alternate Data Stream (ADS) marked with the [ZoneTransfer] header and ZoneId=3, specifically targeting a TargetFilename ending in :Zone.Identifier for file types commonly abused for execution. Attackers can use ADS to attach a Zone.Identifier stream to masquerade as downloaded content or influence how Windows and security checks treat files. The detection relies on Windows telemetry that records stream creation events, including stream contents, the target filename, and the originating process image for browser exclusions.
references:
  - https://www.bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml
author: frack113, Huntrule Team
date: 2022-10-22
modified: 2023-06-12
tags:
  - attack.stealth
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|startswith: "[ZoneTransfer]  ZoneId=3"
    TargetFilename|endswith: :Zone.Identifier
    TargetFilename|contains:
      - .exe
      - .scr
      - .bat
      - .cmd
      - .docx
      - .hta
      - .jse
      - .lnk
      - .pptx
      - .ps
      - .reg
      - .sct
      - .vb
      - .wsc
      - .wsf
      - .xlsx
  filter_optional_brave:
    Image|endswith: \brave.exe
  filter_optional_chrome:
    Image:
      - C:\Program Files\Google\Chrome\Application\chrome.exe
      - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  filter_optional_firefox:
    Image:
      - C:\Program Files\Mozilla Firefox\firefox.exe
      - C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_maxthon:
    Image|endswith: \maxthon.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_opera:
    Image|endswith: \opera.exe
  filter_optional_safari:
    Image|endswith: \safari.exe
  filter_optional_seamonkey:
    Image|endswith: \seamonkey.exe
  filter_optional_vivaldi:
    Image|endswith: \vivaldi.exe
  filter_optional_whale:
    Image|endswith: \whale.exe
  filter_optional_snipping_tool:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.ScreenSketch_
    Image|endswith: \SnippingTool\SnippingTool.exe
    TargetFilename|startswith: C:\Users\
    TargetFilename|contains|all:
      - \AppData\Local\Packages\Microsoft.ScreenSketch_
      - "\\TempState\\Screenshot "
    TargetFilename|endswith: .png:Zone.Identifier
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Other legitimate browsers not currently included in the filter (please add them)
  - Legitimate downloads via scripting or command-line tools (Investigate to determine if it's legitimate)
level: medium
license: DRL-1.1
related:
  - id: 573df571-a223-43bc-846e-3f98da481eca
    type: derived