Windows NTFS Alternate Data Stream Creation with Non-Default Imphash
Alerts on NTFS ADS creation where the stream hash includes a non-null IMPHASH marker, consistent with hidden executables.
- Product
- windows
- Category
- create_stream_hash
- Author
- Florian Roth (Nextron Systems), @0xrawsec (SigmaHQ), DRL 1.1
- Published
- 2018-06-03
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags the creation of an NTFS Alternate Data Stream (ADS) where the stream hash field includes an Imphash value that is not the all-zero placeholder. Attackers can use ADS to hide executable payloads inside a file, reducing visibility in normal file listings. The detection relies on Windows telemetry from Sysmon or an equivalent source that provides stream hash/Imphash data on stream creation events.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows NTFS Alternate Data Stream Creation with Non-Default Imphash
id: c778d13a-96dc-4548-95a2-8e73490ea58e
status: test
description: This rule flags the creation of an NTFS Alternate Data Stream (ADS) where the stream hash field includes an Imphash value that is not the all-zero placeholder. Attackers can use ADS to hide executable payloads inside a file, reducing visibility in normal file listings. The detection relies on Windows telemetry from Sysmon or an equivalent source that provides stream hash/Imphash data on stream creation events.
references:
- https://twitter.com/0xrawsec/status/1002478725605273600?s=21
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml
author: Florian Roth (Nextron Systems), @0xrawsec, Huntrule Team
date: 2018-06-03
modified: 2023-02-10
tags:
- attack.stealth
- attack.s0139
- attack.t1564.004
logsource:
product: windows
category: create_stream_hash
definition: "Requirements: Sysmon or equivalent configured with Imphash logging"
detection:
selection:
Hash|contains: IMPHASH=
filter_main_null:
Hash|contains: IMPHASH=00000000000000000000000000000000
condition: selection and not 1 of filter_main_*
falsepositives:
- This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar.
level: medium
license: DRL-1.1
related:
- id: b69888d4-380c-45ce-9cf9-d9ce46e67821
type: derived