huntrule

Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites

Identifies Windows stream-hash events tied to downloads from file-sharing/paste domains with Zone-tagged payload extensions.

FreeReviewedSigma · High · v2
Product
windows
Category
create_stream_hash
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows events that indicate stream hash creation where the destination content or domain matches common file-sharing and paste hosting services. It also looks for target filenames containing alternate data stream patterns that suggest execution-relevant file types embedded in streams (e.g., .exe, .dll, .vbs) with a ":Zone" suffix. Such activity matters because attackers often stage or hide payloads via public hosting sites and alternate stream techniques. The detection relies on telemetry that includes the stream hash creation context with domain/content strings and target filename details.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange
Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)
Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)
Suspicious Run Key Referencing Alternate Data Stream Payload
macOS chflags Hidden Flag Set via chflags hidden parameter
Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream
Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths
Windows suspicious file download URLs using direct IP address with script/binary extensions
Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs
Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites
Pivot detection · T1564.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.