Windows NTFS Alternate Data Stream Creation with Non-Default Imphash

Alerts on NTFS ADS creation where the stream hash includes a non-null IMPHASH marker, consistent with hidden executables.

FreeReviewedSigma · Medium · v2
Product
windows
Category
create_stream_hash
Author
Florian Roth (Nextron Systems), @0xrawsec (SigmaHQ), DRL 1.1
Published
2018-06-03
Updated
2026-07-31

ATT&CK techniques

Defense Evasion
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Cred Access

  8. Discovery

  9. Lateral Movement

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags the creation of an NTFS Alternate Data Stream (ADS) where the stream hash field includes an Imphash value that is not the all-zero placeholder. Attackers can use ADS to hide executable payloads inside a file, reducing visibility in normal file listings. The detection relies on Windows telemetry from Sysmon or an equivalent source that provides stream hash/Imphash data on stream creation events.

Related detections9 linkedT1564.004 — drag to rearrange
Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)
Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)
Suspicious Run Key Referencing Alternate Data Stream Payload
macOS chflags Hidden Flag Set via chflags hidden parameter
Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream
Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths
Windows suspicious file download URLs using direct IP address with script/binary extensions
Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs
Windows NTFS Alternate Data Stream Creation with Non-Default Imphash
Pivot detection · T1564.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.