Windows CreateStreamHash: Suspicious Embedded File Download Indicators via .zip TLD
Flags Windows downloads indicating .zip/ plus ':Zone' in target filenames for risky executable or script extensions.
- Product
- windows
- Category
- create_stream_hash
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-18
- Updated
- 2026-07-31
What it detects
This rule flags file downloads where the observed content includes a .zip top-level domain path segment and the target filename contains zone-identifier patterns attached to executable and script-like extensions. Such behavior can indicate attempts to distribute payloads via ZIP-hosted content while embedding or referencing zone information (e.g., alternate data stream style indicators). It relies on Windows telemetry that provides stream/content hashes and fields for the streamed contents and the target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows CreateStreamHash: Suspicious Embedded File Download Indicators via .zip TLD"
id: 203897f4-a773-4944-91bc-83fd8f0fe5c9
status: test
description: This rule flags file downloads where the observed content includes a .zip top-level domain path segment and the target filename contains zone-identifier patterns attached to executable and script-like extensions. Such behavior can indicate attempts to distribute payloads via ZIP-hosted content while embedding or referencing zone information (e.g., alternate data stream style indicators). It relies on Windows telemetry that provides stream/content hashes and fields for the streamed contents and the target filename.
references:
- https://twitter.com/cyb3rops/status/1659175181695287297
- https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2023-05-18
tags:
- attack.stealth
logsource:
product: windows
category: create_stream_hash
detection:
selection:
Contents|contains: .zip/
TargetFilename|contains:
- .bat:Zone
- .dat:Zone
- .dll:Zone
- .doc:Zone
- .docm:Zone
- .exe:Zone
- .hta:Zone
- .pptm:Zone
- .ps1:Zone
- .rar:Zone
- .rtf:Zone
- .sct:Zone
- .vbe:Zone
- .vbs:Zone
- .ws:Zone
- .wsf:Zone
- .xll:Zone
- .xls:Zone
- .xlsm:Zone
- .zip:Zone
condition: selection
falsepositives:
- Legitimate file downloads from a websites and web services that uses the ".zip" top level domain.
level: high
license: DRL-1.1
related:
- id: 0bb4bbeb-fe52-4044-b40c-430a04577ebe
type: derived