Windows File Download Indicators of Suspicious Content via .zip TLD

title: Windows File Download Indicators of Suspicious Content via .zip TLD
id: 203897f4-a773-4944-91bc-83fd8f0fe5c9
status: test
description: This rule flags Windows events where downloaded content includes a '.zip/' indicator and the target filename contains file extensions commonly associated with executable or script content (e.g., .bat, .ps1, .dll, .hta, .vbs, .xlsm) followed by ':Zone'. This matters because attackers may deliver malicious files or payloads while using alternate data/zone markers to influence how content is handled by the system or user. The detection relies on Windows stream/file creation telemetry that includes the target filename and content fields.
references:
  - https://twitter.com/cyb3rops/status/1659175181695287297
  - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-05-18
tags:
  - attack.stealth
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection:
    Contents|contains: .zip/
    TargetFilename|contains:
      - .bat:Zone
      - .dat:Zone
      - .dll:Zone
      - .doc:Zone
      - .docm:Zone
      - .exe:Zone
      - .hta:Zone
      - .pptm:Zone
      - .ps1:Zone
      - .rar:Zone
      - .rtf:Zone
      - .sct:Zone
      - .vbe:Zone
      - .vbs:Zone
      - .ws:Zone
      - .wsf:Zone
      - .xll:Zone
      - .xls:Zone
      - .xlsm:Zone
      - .zip:Zone
  condition: selection
falsepositives:
  - Legitimate file downloads from a websites and web services that uses the ".zip" top level domain.
level: high
license: DRL-1.1
related:
  - id: 0bb4bbeb-fe52-4044-b40c-430a04577ebe
    type: derived