huntrule

Windows suspicious file download URLs using direct IP address with script/binary extensions

Alerts on Windows downloads from HTTP/HTTPS direct IP URLs targeting script/binary/shortcut-like filenames.

FreeReviewedSigma · High · v2
Product
windows
Category
create_stream_hash
Author
Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-09-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows file stream creation events where the contents contain an HTTP/HTTPS URL directly referencing an IP address and the target filename includes suspicious file extensions followed by ':Zone'. This pattern can indicate remote payload delivery by an attacker without using a domain name, commonly observed in stealthy download and execution staging. It relies on telemetry from Windows file stream creation/hash events, including the URL present in the stream contents and the target filename value.

Reporting behind it

Related detections9 linkedT1564.004 — drag to rearrange
Suspicious Alternate Data Stream Creation by MuddyWater (via file_event)
Suspicious Command Execution from NTFS Alternate Data Stream via cmd Redirection (via process_creation)
Suspicious Run Key Referencing Alternate Data Stream Payload
macOS chflags Hidden Flag Set via chflags hidden parameter
Windows Process Creation: CLI CommandLine References NTFS ::$index_allocation Stream
Windows Hidden Directory Creation Using NTFS $INDEX_ALLOCATION Stream
Windows rundll32 Launching DLL From Alternate Data Stream (ADS) Paths
Windows Named Pipe Stream Created with Known Hack Tool IMPHASHs
Windows CreateStreamHash: Suspicious Downloads From File Sharing and Paste Websites
Windows suspicious file download URLs using direct IP address with script/binary extensions
Pivot detection · T1564.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.