Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites

Identifies Windows stream-hash events tied to downloads from file-sharing/paste domains with Zone-tagged payload extensions.

FreeReviewedSigma · High · v2

Product: windows
Category: create_stream_hash
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-08-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.004NTFS File Attributes
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows events that indicate stream hash creation where the destination content or domain matches common file-sharing and paste hosting services. It also looks for target filenames containing alternate data stream patterns that suggest execution-relevant file types embedded in streams (e.g., .exe, .dll, .vbs) with a ":Zone" suffix. Such activity matters because attackers often stage or hide payloads via public hosting sites and alternate stream techniques. The detection relies on telemetry that includes the stream hash creation context with domain/content strings and target filename details.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange

Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)

Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)

Suspicious Run Key Referencing Alternate Data Stream Payload

macOS chflags Hidden Flag Set via chflags hidden parameter

Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream

Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream

Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths

Windows suspicious file download URLs using direct IP address with script/binary extensions

Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs

Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites

Pivot detection · T1564.004 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-suspicious-file-download-via-file-sharing-domains-using-sysmon-stream-ha-52182dfb

title: "Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites"
id: b05483d1-0ffa-4b34-ad44-ff11afa07492
related:
  - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
    type: similar
  - id: 8b48ad89-10d8-4382-a546-50588c410f0d
    type: similar
  - id: d635249d-86b5-4dad-a8c7-d7272b788586
    type: similar
  - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
    type: similar
  - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
    type: similar
  - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
    type: similar
  - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
    type: similar
  - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
    type: similar
  - id: b6e04788-29e1-4557-bb14-77f761848ab8
    type: similar
  - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
    type: similar
  - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
    type: similar
  - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
    type: derived
status: test
description: This rule flags Windows events that indicate stream hash creation where the destination content or domain matches common file-sharing and paste hosting services. It also looks for target filenames containing alternate data stream patterns that suggest execution-relevant file types embedded in streams (e.g., .exe, .dll, .vbs) with a ":Zone" suffix. Such activity matters because attackers often stage or hide payloads via public hosting sites and alternate stream techniques. The detection relies on telemetry that includes the stream hash creation context with domain/content strings and target filename details.
references:
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
  - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2026-03-29
tags:
  - attack.stealth
  - attack.s0139
  - attack.t1564.004
logsource:
  product: windows
  category: create_stream_hash
detection:
  selection_domain:
    Contents|contains:
      - .githubusercontent.com
      - 0x0.st
      - anonfiles.com
      - bashupload.com
      - cdn.discordapp.com
      - chunk.io
      - ddns.net
      - dl.dropboxusercontent.com
      - ghostbin.co
      - github.com
      - glitch.me
      - gofile.io
      - hastebin.com
      - mediafire.com
      - mega.nz
      - onrender.com
      - pages.dev
      - paste.ee
      - pastebin.com
      - pastebin.pl
      - pastetext.net
      - pixeldrain.com
      - privatlab.com
      - privatlab.net
      - send.exploit.in
      - sendspace.com
      - storage.googleapis.com
      - storjshare.io
      - supabase.co
      - temp.sh
      - transfer.sh
      - trycloudflare.com
      - ufile.io
      - w3spaces.com
      - workers.dev
      - x0.at
  selection_extension:
    TargetFilename|contains:
      - .cpl:Zone
      - .dll:Zone
      - .exe:Zone
      - .hta:Zone
      - .lnk:Zone
      - .one:Zone
      - .vbe:Zone
      - .vbs:Zone
      - .xll:Zone
  condition: all of selection_*
falsepositives:
  - Some false positives might occur with binaries download via Github
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL